The vulnerability is a memory leak in the DRM Xe component of the Linux kernel. When the xa_store operation fails, the newly allocated data structure is not released, allowing successive allocations until system memory is exhausted. This flaw is a memory leak (CWE‑401) caused by a missing release in the critical path (CWE‑772). The impact is the degradation or loss of service due to resource exhaustion, but it does not provide direct code execution or privilege escalation.

All Linux kernel releases that include the drm/xe/reg_sr subsystem without the commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb are affected. Kernels built from upstream Linux prior to this commit lack the fix.

The CVSS score of 5.5 indicates moderate severity because the flaw compromises availability by exhausting memory resources due to a memory leak (CWE‑401) and missing release (CWE‑772). Its EPSS score of less than 1 % and absence from the CISA KEV catalog imply a low likelihood of exploitation. Based on the description, it is inferred that an attacker would need local privileges and access to DRM Xe operations, possibly via graphical rendering or privileged container environments. Given the need for kernel‑level interaction and the low exploitation probability, the risk is moderate but warrants prompt patching and monitoring.