A flaw in the DRM subsystem of the Linux kernel allows a local user to request a property blob of arbitrary size through the DRM_IOCTL_MODE_CREATEPROPBLOB ioctl. The kernel fails to account the allocated memory for the caller’s memory cgroup, so the memory is not limited by any cgroup quota. An attacker can therefore consume an unbounded amount of kernel memory, which can trigger a system‑wide out‑of‑memory condition and bring the host to a halt. This represents a strong denial‑of‑service risk to the entire system.

All current releases of the Linux kernel that have not been patched to account property blob allocations in memcg are affected. The vulnerability applies to the generic Linux:Linux product irrespective of distribution.

The attack requires only local access and the ability to invoke the ioctl. Because the allocation is unbounded and not restricted by any cgroup limits, an unprivileged user can potentially exhaust kernel memory. The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the KEV catalog, but the potential impact is high and the likelihood of exploitation is moderate to high on systems that expose the DRM subsystem.