The vulnerability exists in the Linux kernel’s host1x driver during device tree parsing. When host1x_device_parse_dt() fails, the driver mistakenly frees the embedded struct device with kfree instead of using put_device, bypassing normal reference counting. This results in a dangling reference that leaks memory and resources, potentially growing without bound and destabilizing the system.

Any Linux distribution that includes the host1x driver in its kernel. Because no specific kernel version is listed, the issue applies to all current and legacy kernels that have not been patched to replace kfree with put_device in the error path.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, requiring an attacker who can trigger device initialization failure or modify the device tree, leading to a reference leak that can cause resource exhaustion and eventual system instability, but does not provide direct code execution.