The Linux kernel’s charger‑manager module contains a reference‑count leak in the is_full_charged() function. When the battery voltage reaches the full‑charge threshold, the function returns without releasing the reference acquired via power_supply_get_by_name(), incrementally raising the reference count for the fuel_gauge power supply. Over many invocations this leak can accumulate, consuming kernel memory and potentially causing a denial‑of‑service by exhausting system resources. This weakness is a reference‑count leak identified by CWE‑911.

All Linux kernel builds that include the charger‑manager module before the commit that introduces the fix (identified by commit 193e6471e985c2f25d09b3fe96ec52f4eab89bd4). The bug is present in all upstream kernels that compile the affected code up to the point of the commit. Consequently, any kernel version older than this commit is potentially vulnerable, regardless of the vendor or distribution shipping the kernel.

The CVSS score of this issue is 5.5, and the EPSS score is less than 1%, indicating a low likelihood of exploitation. The flaw exists in kernel space, so it requires kernel‑level privileges or the ability to trigger the power event that invokes is_full_charged() repeatedly. Based on the description, it is inferred that an attacker could provoke the leak by supplying a battery that reports repeated full‑charge thresholds, allowing the reference count to grow until kernel memory is exhausted. The vulnerability is not currently listed in CISA’s KEV catalog, but its potential for resource exhaustion warrants prompt remediation.