A memory leak in the Linux kernel’s pwrseq‑pcie‑m2 driver occurs when the of_regulator_bulk_get_all() function allocates a consumers array that the driver never frees. This causes unused kernel memory to accumulate over time, potentially exhausting system resources and resulting in degraded performance or system instability. The bug does not provide code execution or elevation of privilege; its primary impact is a denial‑of‑service through resource exhaustion.

The vulnerability exists in any Linux kernel that includes the pwrseq‑pcie‑m2 driver prior to the patch that adds a kfree() for the consumers array. No specific kernel version information is provided, so any affected release remains at risk until the patch is applied.

The CVSS score is 2.3 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the leak occurs when the driver is initialized during PCIe device startup, which means an attacker would need a device that triggers the driver or privileged kernel context to repeatedly invoke the function. This makes exploitation unlikely for a remote attacker and leads to a moderate risk level primarily limited to denial‑of‑service through memory exhaustion.