The vulnerability in the Linux kernel involves a refcount leak in the pcs_add_gpio_func() function of the pinctrl single driver. The function of_parse_phandle_with_args() returns a device_node pointer with an incremented reference count, but the code failed to release these references after use, causing a leak on each iteration. The fix involved adding calls to of_node_put() to properly release the references both after extracting needed arguments and on error paths such as devm_kzalloc() failure. This bug was detected by static analysis and confirmed by code review.

The vulnerability leads to a resource leak (refcount leak) that can degrade system availability by exhausting kernel resources over time. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has resolved the issue by adding proper reference release calls. Users should monitor vendor advisories for an official fix and apply it once available.