The Linux kernel contains a memory leak in the Lenovo WMI helper module. When lwmi_dev_evaluate_int() returns NULL, the output pointer is not freed, leading to a gradual increase in memory usage. This flaw does not grant direct execution of arbitrary code but can degrade system performance or cause a denial of service if the leak is repeatedly exercised over time. It is identified as CWE‑772, improper handling of resource lifetimes.

All Linux systems that use the Lenovo WMI helpers and run a kernel version before the commit that moves the cleanup outside the conditional block are vulnerable. The fix is present in newer kernel releases that include the patch, but distribution backports may provide the update at different version points. Because the vulnerability exists in the kernel, any distribution kernel that contains the line remains at risk until the patch is applied.

The exploitation probability is very low, indicated by an EPSS score of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need local or privileged access to invoke the affected WMI interface, and the flaw cannot be triggered remotely over standard network protocols. Consequently, the risk is primarily theoretical for an attacker who can repeatedly invoke the function, and the vulnerability is most relevant to administrators of systems that expose WMI services via Lenovo firmware.