When a persistent GPIO line is switched from input to output, the code acquires a runtime power‑management reference on the parent device. If the subsequent regmap_update_bits() call fails, the reference is never released, causing a reference‑counting leak. Over time, repeated failures can exhaust kernel resources or destabilize the system, effectively creating a denial‑of‑service scenario. The flaw is a classic example of improper resource deallocation.

All Linux kernel releases that include the arizona GPIO driver before the commit that introduces the fix are affected. The fix is in the kernel source at commit 39748357db26b20a02ea2a25ce48943e6c6d6286. Versions without this commit, regardless of sub‑release, are vulnerable.

The vulnerability is local; an attacker would need the ability to change GPIO direction and trigger a failure in regmap_update_bits, which typically requires kernel or elevated privileges. The CVSS score of 1.9 and an EPSS score of less than 1% indicate a low probability of exploitation and a low overall risk. Since the issue is not listed in CISA’s KEV catalog, widespread use of the exploit is unlikely. Nonetheless, the potential for resource exhaustion warrants timely remediation.