The Linux kernel contains a missing deallocation routine in the DRM Xe (xe) configuration filesystem. Memory allocated for ctx_restore_mid_bb inside wa_bb_store() is never released during device removal, allowing data to remain in kernel memory after the configfs device is released. This oversight can leak sensitive kernel data and is classified as a missing release of allocated memory.

All Linux kernel releases that ship the drm/xe/configfs subsystem without the fix are affected. The vulnerability applies across distributions that include the upstream kernel module; specific version numbers are not listed in the advisory.

The moderate CVSS score of 5.5 reflects a mid-level severity. The EPSS score of < 1% indicates a very low probability that this vulnerability will be actively exploited in the wild, aligning with the lack of publicly disclosed exploits and its absence from the CISA KEV catalogue. An attacker would still require local privileged access or the ability to trigger the removal of a DRM Xe configfs device to trigger the leak, implying a local and privileged attack surface. Overall, the risk remains moderate, with no immediate remote exploitation vectors identified.