The vulnerability is a memory leak in the Linux kernel's Advanced Linux Sound Architecture (ASoC) AMD driver, specifically in the acp3x pdm DMA operations. When the driver operates, it fails to release allocated memory, which can accumulate over time. If the leak is exploited or repeatedly triggered, system memory can be exhausted, resulting in degraded performance or a forced reboot, thus impacting availability. The weakness is a classic resource management flaw, identified as CWE-401.

Affected are Linux kernel images starting from release candidate versions 6.19‑rc1 through 6.19‑rc8 (and any later kernels that include the same code path before the fix). Systems running these kernel builds and drivers that expose the acp3x pdm DMA operations may be impacted.

The CVSS score of 5.5 classifies it as Medium severity. The EPSS score is less than 1 %, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local access to the system and permission to load or use the affected driver; it is not a remote attack vector. The impact mainly manifests as a denial‑of‑service condition if the resource leak is triggered repeatedly.