The vulnerability occurs when a persistent GPIO line configured as an output fails to update its register map; the code acquires a runtime power‑management reference on the parent device but never releases it on failure. As a result, the reference count is left incremented, causing a resource leak. A cumulative leak of this nature can eventually exhaust kernel resources or destabilize the system, leading to a denial‑of‑service condition. The bug directly reflects improper resource deallocation, a classic reference‑counting flaw.

Linux kernels that include the arizona GPIO driver prior to the patch; the issue is present in all kernel releases before the commit that introduced the fix, affecting the vendor product Linux Linux.

The flaw is local; an attacker must be able to switch a GPIO from input to output and trigger a regmap_update_bits failure, which typically requires kernel or elevated privileges. While no CVSS score is listed, the EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Given the need for a failure path on the peripheral register update, exploitation is non‑trivial, but the potential for resource exhaustion and available local privilege elevates the risk to moderate to high in environments with exposed GPIO control.