debugfs_lookup in the Linux kernel incorrectly handles reference counting for the returned dentry and mismanages error pointers when debugging support is disabled. The function returns a dentry with an elevated reference count that is never released, creating a memory leak each time a firmware reset recovery occurs. In configurations where CONFIG_DEBUG_FS is disabled, debugfs_lookup returns an ERR_PTR(-ENODEV) pointer, yet the existing code treats it as a valid dentry and calls dput(), which crashes the kernel. This weakness (CWE‑772) can therefore lead to resource exhaustion or a kernel panic if the conditions are triggered.

All Linux kernel releases that lack the commit correcting debugfs_lookup are affected, including mainstream distributions and custom builds that ship the unpatched kernel source. Devices that perform firmware reset recovery or run with debugfs disabled are especially vulnerable. Because specific vendor‑version data is not provided, any kernel version before the fix should be considered at risk.

The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. No CVSS score is supplied. The reference leak and crash potential signify potential denial of service. Based on the bug, the likely attack vector is a local or privileged user who can trigger a firmware reset or manipulate the debugfs interface; this is inferred from how the bug is activated. Exploitation would lead to local denial of service by exhausting kernel resources or causing a kernel panic, requiring local access.