The kernel function aie2_populate_range() contains a missing mmput(mm) call, causing the kernel to leak a reference to the mm_struct structure each time the code path is executed. The accumulation of unreleased references can lead to memory exhaustion or a denial‑of‑service condition, degrading system stability. The flaw is a resource‑management issue (CWE‑911) and does not grant an attacker code execution or privilege escalation.

Linux kernel deployments that include the accel/amdxdna driver are affected, regardless of kernel version. The vendor and product are listed as Linux:Linux in the CNA data, so any Linux environment that loads this driver without the fix is potentially vulnerable.

The EPSS score is reported as less than 1%, indicating a very low probability of exploitation at present. The CVSS score of 5.5 shows a medium severity vulnerability, and the issue is not listed in the CISA KEV catalog. The risk remains primarily around resource exhaustion. The likely attack vector is internal to the kernel; exploitation would require privileged manipulation or execution of code that triggers the accel/amdxdna loader, so the risk is limited to environments where that driver is active and trusted.