The kernel function aie2_populate_range() contains a missing mmput(mm) call, causing the kernel to leak a reference to the mm_struct structure each time the code path is executed. The accumulation of unreleased references can lead to memory exhaustion or a denial‑of‑service condition, degrading system stability. The flaw is a resource‑management issue (CWE‑911) and does not grant an attacker code execution or privilege escalation.

Linux kernel deployments that include the accel/amdxdna driver are affected, regardless of kernel version. The vendor and product are listed as Linux:Linux in the CNA data, so any Linux environment that loads this driver without the fix is potentially vulnerable.

The EPSS score is reported as less than 1%, indicating a very low probability of exploitation at present. The vulnerability is not listed in CISA KEV, and no CVSS score is provided, so the risk is framed primarily around resource exhaustion. The likely attack vector is internal to the kernel; exploitation would require privileged manipulation or execution of code that triggers the accel/amdxdna loader, so the risk is limited to environments where that driver is active and trusted.