The vulnerability originates in the DRM/VMwgfx driver of the Linux kernel where the surface's dirty tracker is overwritten, causing a memory leak. The leak can gradually consume free memory, which may degrade system performance. It is inferred from typical memory‑leak behavior that a severe case could lead to a local denial of service, but the CVE description does not explicitly mention this outcome. The weakness is specified by CWE‑401 and CWE‑911, indicating a memory‑management flaw and a logical flaw that can result in memory corruption.

Linux kernel distributions running version 6.16 or any of the 7.0 release candidates (RC1–RC7) that have not yet incorporated the patch that fixes the vmwgfx driver bug are affected. Users of any other kernel releases that include the buggy code without the fix are also vulnerable.

The CVSS score of 5.5 reflects a moderate risk. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. No publicly documented remote exploitation path is provided; the impact appears limited to local memory exhaustion. Exploitation would require triggering the code that overwrites the dirty tracker, which is typically a local action.