The vulnerability occurs when the `qrtr_send_resume_tx()` function calls `qrtr_node_lookup()`, obtaining a reference to a QRTR node, but then fails to release that reference if the following `qrtr_alloc_ctrl_packet()` allocation fails. This missing release creates a reference count leak which can increase the node’s reference count beyond its intended bounds. The fail‑to‑release also opens a path for resource exhaustion (CWE-911) if repeated over time; a persistent leak may result in wasted kernel memory and could contribute to memory exhaustion conditions, though the official description does not confirm an immediate denial‑of‑service scenario.

All Linux kernel builds that contain the QRTR driver but lack the patch brought in by commit c3b09ff are affected. This includes every kernel version released prior to that commit across all Linux distributions that provide the standard kernel package.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. No publicly documented exploits exist. Triggering the leak requires a memory allocation failure while transmitting a QRTR control packet, which is not trivial for an attacker to force. The risk is primarily the potential for incremental memory consumption that could degrade kernel stability in long‑running or high‑memory‑pressure environments, potentially leading to denial‑of‑service if memory eventually expires.