The samsung-dsim driver in the Linux kernel mismanages the TE GPIO resource by using a managed descriptor but not releasing it when the DSI host is reattached. Each reattach request can acquire the GPIO again without freeing the previous descriptor, leading to a leakage of GPIO handles. This resource leakage can, over time, exhaust the available GPIO pool and cause subsequent kernel operations that depend on GPIOs to fail or the system to become unstable. The CVE description does not explicitly state a denial‑of‑service outcome, but it is inferred that the continued accumulation of unreleased descriptors could eventually result in service disruption.

All Linux kernel builds that include the samsung‑dsim driver prior to the commits referenced in the advisory are affected. This includes distribution kernels and custom builds that compile the driver without the applied fix and do not specify a patched version range.

The CVSS score of 4.4 indicates a moderate risk level. The EPSS score is < 1%, which translates to a very low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require repeated DSI host attach/detach cycles, typically achievable only by local or privileged users with access to the device that governs the driver. While remote exploitation remains unlikely, systems that allow frequent host reattachment or users with elevated privileges could induce a GPIO resource exhaustion condition that leads to a denial of service.