The vulnerability originates from a refactor of the Linux kernel HID Steam driver in which the logic to unregister a battery power_supply when later registration steps fail was omitted. As a consequence, if registration fails after initial allocation, an orphaned power_supply object remains after the steam device is torn down. This lingering object consumes kernel memory and potentially other resources, which can degrade system performance or exhaust system resources over time.

All Linux distributions that ship the unpatched HID Steam driver are impacted. The Common Platform Enumeration indicates any kernel that includes this driver without the patch, regardless of specific kernel version. No specific version numbers are listed, so any system using the vulnerable driver code is susceptible.

The CVSS score of 7.8 reflects a moderate to high severity and indicates that the resource leak could have significant impact. The vulnerability involves kernel module lifecycle management, which typically requires privileged local access to load or unload modules. Based on the description, it is inferred that an attacker would need the capability to trigger the driver unload to trigger the resource leak. The EPSS score is below 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, meaning no public evidence of exploitation is known. The absence of a publicly available exploit and the likely need for privileged access suggest a moderate risk; however, repeated failures could lead to a denial of service if the resource consumption is significant.