The Linux kernel's usb gadget printer function (f_printer) had a flaw where printer_open() would increment the device's reference count (kref) regardless of whether the open succeeded or failed. Specifically, when printer_open() returned -EBUSY indicating the device was already open, it still incremented dev->kref. Since VFS does not call the release method on failed opens, this caused a permanent leak of one reference per rejected open attempt. The vulnerability was fixed by moving the kref_get() call into the branch that executes only on successful opens, preventing the reference leak.

The vulnerability causes a permanent reference count leak in the kernel when multiple open attempts are rejected. This can lead to resource exhaustion in the kernel over time, potentially degrading system stability or causing denial of service due to leaked references. There is no indication of code execution or privilege escalation from this issue.

A fix has been implemented in the Linux kernel to address this issue by adjusting the reference counting logic in printer_open(). Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel mailing lists or vendor advisories for the current remediation guidance.