This flaw occurs when opening a DRM XE OA stream with an execution queue width greater than one. The driver immediately returns an error, bypassing the cleanup code that would release a reference obtained from xe_exec_queue_lookup. Consequently, the reference to the execution queue is leaked, keeping both the queue and the associated file state pinned in memory. Over repeated openings this can accumulate unreleased references, consuming kernel memory and potentially causing the system to become unresponsive or trigger a denial of service.

All Linux kernel releases that include the drm/xe/oa driver without the commits referenced in the advisory are affected. This includes stock kernels shipped by major distributions that have not yet incorporated the patch commits 04ef7592eaadd9ca8f8f66e76452f73525cff819, 4b0c4f0c1b133d4bfa31c167200bcda646873328, or 4d25342543c01310fc4e0cba7cb17c775e2421e2. Versions lacking these fixes should be considered vulnerable. No specific version numbers are provided in the CVE data, so affected releases cannot be narrowed beyond the absence of the mentioned commits.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a very low probability of exploitation in the wild. Nonetheless, repeated openings of DRM streams that specify a width greater than one can trigger the leak, potentially exhausting kernel memory and causing denial of service. The absence of a public exploit further reduces the likelihood of real‑world exploitation.