The vulnerability in the Linux kernel affects the riscv architecture's cacheinfo subsystem. In the populate_cache_leaves function, a while loop iterates over nodes, releasing references to the previous node each iteration. If the loop ends early via a break, the current node reference is properly released. However, if the loop ends naturally when the node pointer becomes NULL, the final call to release the node reference is a no-op, leaving the last valid node's reference unreleased, causing a node reference leak. The fix changes the final reference release call from the current node pointer to the previous node pointer, ensuring the last node's reference is properly dropped.

The vulnerability causes a node reference leak in the kernel's device tree cacheinfo handling on riscv architectures. This leak could lead to increased memory usage or resource exhaustion over time but does not directly indicate code execution or privilege escalation. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel source code by correcting the reference release logic in the populate_cache_leaves function. Users should update to the latest kernel versions containing this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the exact fixed versions and apply updates accordingly.