The vulnerability is a memory leak in the IDXD DMA engine driver of the Linux kernel. During a workqueue reset, its routine sets the workqueue type to NONE before freeing the allocated resources, causing the memory associated with the workqueue not to be released. This ordering leaves dangling allocation, and each reset can increase the kernel’s memory footprint. The bug does not grant additional privileges or allow code execution; its impact is confined to resource depletion, which can eventually lead to application crashes or a system restart.

All Linux kernels that include the IDXD DMA engine driver and have not yet incorporated the upstream patch are affected. No specific kernel versions are enumerated in the advisory, so the vulnerability applies to any unrevised kernel instance containing the driver.

The CVSS score of 5.5 classifies this issue as moderate. The EPSS score of <1% indicates a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. The likely attack vector is local; an adversary would need to trigger a reset of an IDXD workqueue, a scenario tied to privileged or kernel‑level execution. While excessive resets could, in theory, cause memory exhaustion, such a scenario requires sustained, repeated kernel‑level operations, making exploitation unlikely without elevated access.