An unbalanced reference count occurs in the Linux kernel’s ASoC Intel audio subsystem when strace_open() attempts to acquire a module reference via try_module_get() but does not decrement the count if subsequent operations fail. The resulting incorrect reference count prevents the module from unloading properly, potentially causing memory leaks and overall kernel instability. The flaw is an instance of improper reference counting (CWE-911) and could lead to a denial‑of‑service scenario if an attacker can trigger the faulty code path.

The vulnerability targets the Linux kernel, affecting all releases distributed by the Linux:Linux vendor that contain the buggy ASoC Intel audio driver before the commit referenced by the provided SHA identifiers. Any kernel built prior to those commits remains susceptible until the patch is integrated.

The CVSS score is 5.5, indicating a medium severity, and the EPSS score is less than 1%. The vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation has not been observed. The impact on kernel stability is significant. The likely attack vector involves processes that invoke strace_open() or related file operations, potentially local or remote. Until the kernel is updated with the fix, the risk is considered moderate for affected systems.