During PCI P2P DMA page mapping, a failure in vm_insert_page() triggers p2pmem_alloc_mmap() to skip a required per‑CPU reference release. The unreleased reference keeps the system from unmapping the PCI device, causing memunmap_pages() to block forever. This results in a system hang that disrupts availability but does not directly expose data or modify state. The flaw represents a resource‑leak scenario where an invalidated reference count prevents clean de‑allocation, exacerbating the kernel’s inability to reclaim resources.

The vulnerability affects Linux kernel implementations that provide the PCI P2P DMA page‑allocation path, specifically those using the p2pmem_alloc_mmap routine and the per‑CPU pgmap reference counting. It applies to all kernels that have not incorporated the commit that adds the missing percpu_ref_put() call, regardless of distribution or patch level.

No public exploit or documented attacks are currently known, and the EPSS score is undefined. The defect does not expose remote code execution, but a local attacker with the ability to initiate PCI device removal could force a kernel deadlock. Because the failure path requires a specific kernel function to fail during page insertion, exploitation is unlikely unless additional vulnerabilities allowing arbitrary kernel writes exist. The KEV catalog does not list this CVE, so it is not known to have active exploitation in the wild.