A flaw in the DRM subsystem of the Linux kernel allows a local user to request a property blob of arbitrary size through the DRM_IOCTL_MODE_CREATEPROPBLOB ioctl. The kernel fails to account the allocated memory for the caller’s memory cgroup, so the memory is not limited by any cgroup quota. An attacker can therefore consume an unbounded amount of kernel memory, which can trigger a system‑wide out‑of‑memory condition and bring the host to a halt. This represents a strong denial‑of‑service risk to the entire system.

Affected version information is not available; the vulnerability is documented for Linux:Linux but specific kernel releases that require the fix cannot be identified at this time.

Based on the description, it is inferred that the attack requires only local access and the ability to invoke the ioctl. Because the allocation is unbounded and not restricted by any cgroup limits, an unprivileged user can potentially exhaust kernel memory. The CVSS score of 5.5 indicates moderate severity. The EPSS score is < 1% and the vulnerability is not listed in the KEV catalog, but the potential impact is high and the likelihood of exploitation is low on systems that expose the DRM subsystem.