The Linux kernel's drm/logicvc component contained a device node reference leak in the logicvc_drm_config_parse() function. This function called of_get_child_by_name() to find the "layers" node but neglected to release the reference, resulting in a resource leak. The issue was resolved by applying the __free(device_node) cleanup attribute to ensure automatic release of the reference when the variable goes out of scope. This fix is included in linux-hwe-edge kernel versions 6.8.0-1064.72 and later. The vulnerability has a CVSS 3.1 score of 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating and rebooting the system.

The vulnerability causes a device node reference leak which can lead to resource exhaustion and potential denial of service (availability impact). There is no impact on confidentiality or integrity. The CVSS score of 5.5 reflects a medium severity due to the availability impact. No known exploits in the wild have been reported.

An official patch is available and has been released by the vendor. Users should update their linux-hwe-edge kernel to version 6.8.0-1064.72 or later (and other specified fixed versions) and reboot the system to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor's update instructions carefully.