Technical impact
This vulnerability involves the Linux kernel’s drm/xe/sync subsystem, where a memory leak occurs when dma_fence_chain_alloc fails and the user fence reference is not released. The leak could allow repeated allocation failures to consume system memory, potentially destabilizing the kernel or causing a denial‑of‑service scenario if unbounded memory exhaustion is achieved. The underlying weakness corresponds to improper resource management.
Affected Systems
Vendors affected include Linux kernel distributions. The issue is present in any kernel that contains the unpatched drm/xe/sync code prior to the application of the commit that resolves the leak. No specific version range is listed; administrators should reference Linux kernel upgrades that incorporate this patch.
Risk and Exploitability
The CVSS score is 5.5, indicating moderate severity. The EPSS score is 0.00022 (<1%), indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly stated; based on the description it is inferred that the flaw is a kernel‑level resource leak that would only manifest under conditions of allocation failure, so it is unlikely to be directly exploitable remotely but could be leveraged locally to exhaust memory and degrade system availability.
