The vulnerability occurs when the `qrtr_send_resume_tx()` function calls `qrtr_node_lookup()`, obtaining a reference to a QRTR node, but then fails to release that reference if the following `qrtr_alloc_ctrl_packet()` allocation fails. This missing release creates a reference count leak, which can potentially increase the node’s reference count beyond its intended bounds. A persistent leak may result in wasted kernel memory and, over time, could contribute to memory exhaustion conditions, though the official description does not confirm an immediate denial‑of‑service scenario.

All Linux kernel builds that contain the QRTR driver but lack the patch brought in by commit c3b09ff are affected. This includes every kernel version released prior to that commit across all Linux distributions that provide the standard kernel package.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. No publicly documented exploits exist. Triggering the leak requires a memory allocation failure while transmitting a QRTR control packet, which is not trivial for an attacker to force. The risk is primarily the potential for incremental memory consumption that could degrade kernel stability in long‑running or high‑memory‑pressure environments.