The kernel firmware update routine failed to release firmware objects when validation failed, creating a persistent memory leak. Repeated update attempts or continuous validation failures could consume kernel memory, leading to degraded performance or a system crash. The vulnerability corresponds to CWE-772. The impact is that an attacker or faulty firmware update process can exhaust memory and cause denial of service on the affected machine.

The vulnerability affects the Linux kernel. Specific vendors are listed as Linux:Linux, indicating all Linux kernel releases prior to the fix could be impacted. No explicit version range is provided, so any kernel build without the patch implementing the firmware object cleanup is potentially vulnerable.

The EPSS score is < 1% and the CVSS score is 5.5, indicating moderate severity but very low exploitation probability. It is not listed in the CISA KEV catalog, suggesting limited public exploitation data. However, a local privileged user or a compromised firmware update utility could trigger sufficient failures to exhaust memory. The absence of an exploit publicized does not eliminate risk; the firmware update path remains a feasible local attack vector, with the likelihood of exploitation depending on the frequency of firmware validation failures in the target environment.