In the Linux kernel, the IMSIC early ACPI initialization routine can allocate a firmware node and then, if the IMSIC state setup fails, fail to free that node. The result is a memory leak that persists until the driver is reloaded or the system is rebooted. The leaked reference consumes kernel memory over time, potentially degrading system performance or leading to a denial‑of‑service state for processes that require kernel resources.

The vulnerability affects all Linux kernel builds that include the IMSIC early ACPI driver for RISC‑V, as identified by the Linux kernel CPE namespace. No specific kernel version range is supplied in the advisory, so any build that compiles this code and enables the driver may be impacted until the patch is applied.

The CVSS score of 5.5 and an EPSS score of less than 1% indicate a moderate severity but a very low documented exploitation probability. The defect is internal to the kernel; it is not publicly known to be exploitable from user space. Based on the description, it is inferred that the error path is triggered during early boot or when the driver is probed, which requires kernel execution context. An attacker would therefore need to cause the IMSIC state setup to fail—e.g., by supplying malformed or missing ACPI data—to trigger the leak. The risk of exploitation is further mitigated by the lack of a publicly available exploit and the fact that the vulnerability is not listed in the CISA KEV catalog.