The vulnerability is a memory leak caused by incomplete cleanup of operating‑point tables in the Linux kernel’s apple‑soc cpufreq driver. With the driver loading firmware‑supplied OPP tables, failure paths fail to remove entries and an incorrect helper is used for firmware‑loaded entries, leaving stale tables resident in memory. The leak can accumulate over time, potentially exhausting kernel memory and degrading system stability, but it does not affect confidentiality, integrity, or authentication.

The apple‑soc cpufreq driver is part of the Linux kernel. Any kernel release that includes the unpatched driver is affected; specific kernel versions are not enumerated in the CVE data, so all such releases remain at risk.

The CVSS score of 2.3 signals low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability requires a local kernel interaction during driver initialization and can be triggered by a driver load failure, such as a reboot or module reload. No remote attack vector or privilege escalation is documented, and it is not listed in the CISA KEV catalog, limiting the risk mainly to local resource exhaustion.