The SCMI regulator driver in the Linux kernel leaks a device‑node reference whenever probe fails because the error path does not call of_node_put. This reference‑count leak is a classic resource‑management flaw that can accumulate over time, eventually exhausting kernel memory and destabilizing the system, which may manifest as a denial of service.

Any Linux kernel configuration that includes the SCMI regulator driver is susceptible; no explicit version range is provided, so all builds prior to the patch may be affected.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of real‑world exploitation. However, the vulnerability has a moderate CVSS score of 5.5, and an attacker with privileged local access could repeatedly trigger probe failures or load/unload the driver to accumulate the reference leak and exhaust kernel memory. The likely attack vector is local kernel manipulation or driver reload, as the flaw occurs during driver initialization.