A defect in the Linux kernel’s remoteproc subsystem caused a device reference leak known as a resource leak (CWE‑772) when the driver data for an SCP device could not be found during lookup. The reference to the device is not released, allowing the memory and reference counter associated with the SCP device to accumulate over time and potentially exhaust kernel resources. This leads to degraded system performance or a denial‑of‑service state rather than immediate data exfiltration or code execution.

The flaw affects all Linux kernel builds that include the remoteproc SCP driver; no specific kernel versions are listed, so the impact applies broadly to all affected releases until they incorporate this fix.

The CVSS score of 4.4 indicates moderate severity. The EPSS score of <1% indicates a very low estimated exploitation probability, and the vulnerability is not cataloged in CISA’s KEV list, suggesting low public exploitation likelihood. However, a local user with sufficient privileges could trigger the resource leak repeatedly, forcing the kernel to allocate additional references until subsystem stability is compromised. The likely attack vector is local privilege escalation or a privileged kernel module that triggers failed SCP device lookups.