In the Linux kernel power supply subsystem, the CPCAP battery driver fails to call nvmem_device_put() after retrieving an nvmem device with nvmem_device_find(). This omission means the reference count for the device never decreases, resulting in a permanent reference leak. Over time the leak can accumulate, exhausting kernel memory resources and potentially degrading system performance or causing crashes. The flaw does not provide a path to arbitrary code execution or unauthorized privilege escalation; its primary danger is the gradual depletion of kernel resources.

The vulnerability pertains to the Linux kernel’s CPCAP battery driver, which is part of the power supply subsystem. Exact kernel version information is not specified, so any kernel build that includes the unpatched version of this driver is potentially affected. The affected products are generic Linux kernels where the CPCAP battery driver is enabled.

The security metrics for this vulnerability indicate a CVSS score of 5.5 and an EPSS score of less than 1%. It is not listed in the CISA KEV catalog, which suggests no known public exploitation as of this analysis. The likely attack vector is local; an attacker would need to trigger repeated battery reads or enable the driver on a target device. Because the flaw only consumes kernel resources, the risk is moderate. An attacker could induce resource exhaustion by causing many battery detections, but the vulnerability does not provide direct persistence or elevated privileges.