An incorrect reference release in the RISC‑V cacheinfo module causes the last valid device tree node to retain a reference after the discovery loop terminates normally, creating a memory/resource leak that can gradually consume kernel memory. The flaw corresponds to the resource‑management weakness CWE‑772 and is strictly a local kernel‑level issue; it does not provide a direct attack surface for remote code execution or data exfiltration.

All Linux kernel installations that include the RISC‑V cacheinfo component and are running a kernel version that predates the patch introducing the reference drop change remain vulnerable. Because the CPE string indicates the Linux kernel broadly, any kernel that incorporates the legacy logic (before the relevant commit or backport) is at risk. Updating to a kernel that incorporates the change – either by installing a patched distribution package or by backporting the commit – removes the leak.

The CVSS score is 5.5, the EPSS score is <1%, and it is not listed in the CISA KEV catalog. Based on the description it is inferred that the exposure is limited to a local kernel context; the flaw does not provide privileged code execution or remote data access. Consequently, the threat of exploitation is low. However, over extended periods a kernel that repeatedly loads the cacheinfo module could see an incremental memory drain, which could culminate in a denial‑of‑service scenario or kernel instability. Administrators should treat the issue as medium risk that warrants timely patching, especially on long‑running or production deployments.