During Dell laptop initialization, the kernel function dell_init creates several resources, including the optional touchpad LED, keyboard backlight LED, battery hook, a debugfs directory, and a notifier. If registration of a later LED or backlight fails, the current cleanup path only removes the battery hook and rfkill resources. This leaves the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED registered after dell_init returns an error. The resulting resource leak can expose kernel objects to user space, potentially revealing internal state or debug interfaces. The weakness is a resource release flaw (CWE‑772). Based on the description, it is inferred that an attacker with local access could interact with the lingering objects to gain information or create a foothold for further exploitation.

Affected systems are Linux kernels running the legacy Dell laptop platform code that lack the commit adding the missing cleanup logic. The exact kernel versions are not listed; any distribution shipping an older upstream kernel without this patch is susceptible. Users should verify whether their running kernel contains the commit before assuming protection.

The CVSS score of 7.8 places this vulnerability in the high‑severity range. However, its EPSS score of less than 1 % indicates a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an error during LED or backlight registration to trigger the leak. Based on the description, it is inferred that exploitation would need the ability to induce the failure path, perhaps by manipulating device settings or disabling the registration. While direct escalation is not documented, the persistent objects could enable accidental information disclosure or serve as a vector for future privilege‑escalation attacks, making the overall risk moderate to high but the immediate threat low.