In the Linux kernel’s drm/nouveau driver, a failure in aperture_remove_conflicting_pci_devices() during probe causes the function to return early without freeing the nvkm_device that was just allocated by nvkm_device_pci_new(). The device wrapper and the pci_enable_device() reference remain unreleased, creating a memory and PCI resource leak that may lead to kernel memory exhaustion or stale PCI references. The vulnerability is a CWE‑772: Resource Leak, indicating the kernel fails to properly release allocated resources.

All systems running a Linux kernel with the Nouveau NVIDIA graphics driver prior to the patch that incorporated the commit referenced in the provided URLs. No specific version range is specified, but the flaw existed until that kernel update.

The flaw is local to the kernel and requires a probe failure that can be induced by locally executing code or manipulating kernel module loading. There is no CVSS score, but the EPSS score is not available and the vulnerability is not listed in CISA KEV. Because the issue only allows resource exhaustion, the risk is moderate; a determined local attacker could repeatedly trigger probe failures to deplete kernel memory or PCI device reference counts, potentially leading to a denial of service.