The flaw is a reference‐count leak in the Linux kernel’s firmware_loader, triggered when firmware_upload_register() fails to release a device reference after a successful fw_create_instance() call. Because the embedded struct device’s reference counter is not decremented, the leaky reference can accumulate over time. The vulnerability does not expose code execution or privilege escalation; its impact is limited to resource exhaustion that may eventually cause service disruption or system instability.

All Linux kernel configurations that include the legacy firmware_loader implementation are potentially affected, as the vulnerability resides in core kernel code. The issue applies to every distribution that ships an unpatched kernel containing the vulnerable firmware_loader module. Specific version information is not provided, so any kernel image using the pre-2026 firmware_loader codebase may be at risk until the fix is applied.

The CVSS score of 5.5 and an EPSS score of less than 1% indicate a moderate severity but a low probability of exploitation. The kernel component is invoked when firmware upload operations occur, so an attacker would need access to that interface or untrusted firmware to trigger the leak. The vulnerability is listed as not in CISA KEV, reducing immediate concern for widespread exploitation. Because the flaw does not lead to data disclosure or privilege escalation, the risk remains mainly that repeated failures could accumulate a reference count leak, potentially degrading system stability over time.