This vulnerability resides in the Linux kernel’s drm/vc4 driver and results in a memory leak of the BO array during a hang state. The array is allocated with kzalloc() but never freed, allowing an attacker or benign usage pattern to accumulate unreclaimed memory over time. If the leak is exercised repeatedly, it could deplete system memory, potentially causing kernel panics or severely degraded performance, thus representing a denial‑of‑service risk. The Weakness Category is Memory Leak (CWE‑401).

All Linux kernel builds that include the drm/vc4 driver are affected. No specific kernel versions were listed in the advisory, so any system running the driver before the described patch is potentially vulnerable.

The vulnerability does not have an associated EPSS score or CVSS vector in the advisory, and it is not listed in the CISA KEV catalog. Exploitation would require triggering the hang state or similar error condition that causes the BO array to be allocated. Because the condition involves normal kernel driver operation, the likelihood is uncertain but not negligible, especially on systems with heavy GPU or DRM usage. Overall risk is moderate, with potential for a DoS outcome if the leak is repeatedly exercised.