The vulnerability is a reference leak in the Linux kernel’s DRM Adreno driver: during a6xx_gpu_init() the device node retrieved with of_parse_phandle() is not released on several early error returns, causing a leaking reference. This loss of resources can accumulate and potentially lead to system instability or denial of service. The weakness is classified as CWE-911 and does not provide a remote or network‑based attack vector, but could be triggered by local privileged code that loads or initializes the driver. Based on the description, it is inferred that the attack vector requires local or escalated privileges and cannot be exploited remotely.

Linux kernel builds that include the drm/msm/adreno driver for Adreno 6xx GPUs. No specific kernel version range is listed, so any distribution’s kernel that contains this driver could be affected. The CVE does not specify a particular vendor or release, but the patch applies to all kernels with the a6xx_gpu_init function.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. Because the leak occurs during driver initialization in kernel mode, an attacker would need local or escalated privileges. The overall risk is low to moderate, and exploitation would likely require targeted, local activity rather than an arbitrary remote exploit.