The Linux kernel contains a reference‑count leak in the virtio GPU driver. When the function virtio_gpu_dma_fence_wait fails and returns early, a cursor chain reference is not released, causing a gradual build‑up of unreleased DMA fence objects. Over time this leak can exhaust kernel memory, degrade performance and potentially result in a denial of service. The weakness is a resource leak (CWE‑414).

All Linux kernel builds that ship the virtio GPU driver prior to the commit adding the missing dma_fence_put are affected. No specific version range is given, so any kernel that has not applied the patch is at risk.

The vulnerability is not listed in CISA KEV and lacks an EPSS score, so the exploitation probability is unknown. Based on the description, it is inferred that an attacker would need to trigger the failure path in virtio_gpu_do_fence_wait, which is likely limited to workloads that exercise GPU acceleration or privileged users. Consequently, the risk is chiefly an internal denial of service rather than remote code execution.