In the Linux kernel’s drm/nouveau driver, a failure in aperture_remove_conflicting_pci_devices() during probe causes the function to return early without freeing the nvkm_device that was just allocated by nvkm_device_pci_new(). The device wrapper and the pci_enable_device() reference remain unreleased, creating a memory and PCI resource leak that may lead to kernel memory exhaustion or stale PCI references. The vulnerability is linked to two weaknesses: CWE‑401 (Memory Leak) and CWE‑772 (Resource Leak), indicating the kernel fails to properly release allocated resources.

All systems running a Linux kernel with the Nouveau NVIDIA graphics driver prior to the patch that incorporated the commit referenced in the provided URLs. No specific version range is specified, but the flaw existed until that kernel update.

The flaw is local to the kernel and requires a probe failure that can be induced by locally executing code or manipulating kernel module loading. The CVSS score of 5.5 indicates a medium severity, and the EPSS score of < 1% suggests a very low exploitation probability; the vulnerability is not listed in CISA KEV. Because the issue only allows resource exhaustion, the risk remains moderate; a determined local attacker could repeatedly trigger probe failures to deplete kernel memory or PCI device reference counts, potentially leading to a denial of service.