The Linux kernel contains a missing deallocation routine in the DRM Xe (xe) configuration filesystem. Memory allocated for ctx_restore_mid_bb inside wa_bb_store() is never released during device removal, allowing data to remain in kernel memory after the configfs device is released. This oversight can leak sensitive kernel data and is classified as a missing release of allocated memory.

All Linux kernel releases that ship the drm/xe/configfs subsystem without the fix are affected. The vulnerability applies across distributions that include the upstream kernel module; specific version numbers are not listed in the advisory.

The moderate CVSS score of 5.5 reflects a mid-level severity. No publicly disclosed exploits are known and the vulnerability is not listed in the CISA catalogue. An attacker would need local privileged access or the ability to trigger the removal of a DRM Xe configfs device to trigger the leak, implying a local and privileged attack surface. Overall, the risk is considered moderate, with no immediate remote exploitation vectors identified.