Technical impact
The vulnerability is present in the Linux kernel's amdgpu driver. In the function amdgpu_acpi_enumerate_xcc, an allocated structure named xcc_info is not freed when amdgpu_acpi_dev_init returns -ENOMEM, creating a memory leak. Over time, repeated execution of this error path could exhaust kernel memory, destabilizing the system or triggering a reboot. The weakness corresponds to a classic memory‑leak flaw.
Affected Systems
All Linux kernels that include the amdgpu driver prior to the application of the patch are affected. No specific kernel version range is listed, so any installation running the default amdgpu module before the fix is vulnerable.
Risk and Exploitability
The EPSS score is reported as less than 1%, indicating a very low probability of exploitation, and a CVSS score of 5.5 is assigned, classifying the vulnerability as Medium severity. Based on the description, it is inferred that the attack vector requires local privileged interaction with kernel ACPI enumeration routines; a non‑privileged user would not be able to trigger the leak alone. An attacker with such access could repeatedly invoke the problematic code path to deplete kernel memory, potentially causing a denial‑of‑service. The vulnerability is not listed in the CISA KEV catalog, indicating no known in‑the‑wild exploitation at the time of the advisory.
Ubuntu USN