One flaw in the Linux kernel’s wlcore wireless driver causes an unbalanced runtime power‑management reference when the regulatory‑domain configuration command fails. The function wlcore_regdomain_config() acquires a reference before sending the command, but if the command fails it queues a recovery task and returns without releasing that reference. The recovery worker takes a separate reference, meaning the original reference remains held, leading to reference count leakage. This mismatch could, over time, result in unavailable runtime PM resources and represent a denial‑of‑service condition.

All Linux kernel builds that include the wlcore driver and have not yet incorporated the upstream fix are affected. This includes any distribution shipping the stock kernel with wlcore enabled, as well as custom kernels that compile the wlcore module without the corrective change.

The CVSS score of 5.5 classifies the issue as moderate severity, and the EPSS score of less than 1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that an attacker would need to execute a failed regulatory‑domain configuration from a user or user‑space process, implying a local or privileged context. Without such access the flaw cannot be triggered.