The vulnerability arises from an imbalance in runtime power‑management reference counting within the QCOM iris driver. Because the driver uses pm_runtime_resume_and_get() and pm_runtime_put_sync() inconsistently on error paths, a failure can leave a usage counter incremented while the resource remains unused. This leak can accumulate over time, potentially exhausting kernel resources or creating inconsistency in power states.

All Linux kernel builds that contain the QCOM iris driver and have not incorporated the described patch. The issue is present in the kernel source tree, so any kernel version prior to the commit that brings the runtime PM reference balance is at risk.

The CVSS score is 3.3, EPSS is < 1%, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires local access to the kernel or the driver, so it would be limited to attackers with privileged or local kernel exploitation capabilities. While the potential impact involves resource exhaustion or power‑management inconsistency, the lack of publicly available exploits and the need for elevated privileges reduce the immediate risk level.