debugfs_lookup() returns a dentry with an elevated reference count that is never released, causing a reference leak on every firmware reset recovery. When CONFIG_DEBUG_FS is disabled, the function returns an ERR_PTR(-ENODEV) pointer but the code treats it as a valid dentry and calls dput(), leading to a kernel crash. The affected weakness is a reference leak (CWE-401) and an improper release (CWE-772). The result is memory exhaustion or a kernel panic, which can be triggered by the proper use of the debugfs interface or during firmware reset operations.

Linux kernels that lack the commit 26e19622c485e53c3fdb299e822068a0542ddf0c are affected. This includes the 6.8 and early 7.1 release candidates listed in the known CPEs, as well as any custom or mainstream distribution builds shipping the unpatched kernel source. Devices that perform firmware reset recoveries or that run with CONFIG_DEBUG_FS disabled are especially at risk.

The EPSS score of <1% indicates a very low likelihood of exploitation, and the CVSS score of 5.5 assigns medium severity. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged access that can trigger a firmware reset or manipulate the debugfs interface. Exploitation would cause local denial of service by exhausting kernel resources or by provoking a kernel panic, requiring the attacker to have the ability to execute code or control the system to trigger the conditions.