The vulnerability is a memory leak in the DRM Xe component of the Linux kernel. When the xa_store operation fails, the newly allocated data structure is not released, allowing an attacker to repeatedly allocate memory until the system is exhausted. This flaw can lead to degraded performance or a crash, but it does not grant direct code execution or privilege escalation. It falls under CWE‑772 (Missing Release in Critical Path).

All Linux kernel releases that include the drm/xe/reg_sr subsystem without the fix are affected. The patch implementing the fix is present from kernel commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb forward, so any kernel built from upstream Linux before that commit is vulnerable.

The CVSS score of 5.5 indicates moderate severity, reflecting that while the flaw does not compromise confidentiality or integrity, it can affect availability by exhausting memory resources. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. The attack requires privileged access to trigger DRM Xe operations, typically achievable by local users with graphics rendering capabilities or applications running in privileged containers. Given the requirement for kernel‑level interaction and the low exploitation probability, the risk is moderate, but regular monitoring and prompt patching are recommended.