The flaw lies in the Linux kernel’s AMDGPU driver, where a failure in the amdgpu_nbio_ras_sw_init() function causes the amdgpu_ras_init() routine to return without freeing an allocated ‘con’ structure. This oversight leads to a memory leak each time the failure path is exercised, ultimately consuming kernel memory and potentially degrading or halting system performance. The weakness is a classic resource leak (CWE-772) that can only be triggered during RAS initialization and is not exploitable remotely without additional preconditions.

Any Linux kernel containing the AMDGPU driver and compiled with RAS support before the patch are affected. No specific kernel releases are enumerated, so any deployment of a kernel version older than the one that includes the amdgpu_ras_init fix may be vulnerable.

The CVSS score is not supplied and the EPSS score is unavailable, indicating no actively exploited incidents are known. The attack surface is inferred to be limited to users or processes that can repeatedly trigger driver initializations—typically a local or privileged attacker. Because exploitation requires repeated failures, the overall risk is low to moderate, with the primary consequence being a gradual exhaustion of kernel memory leading to resource denial.