In the Linux kernel, a reference leak occurs within the DRM gpusvm driver when kvmalloc_array() fails during drm_gpusvm_range_evict. Based on the description, it is inferred that the MM reference acquired before the allocation is not released, resulting in a kernel resource leak. This weakness is a classic case of unreleased resource usage and is classified as CWE‑772 and CWE‑911, potentially undermining kernel stability and causing a denial of service if the leaked references accumulate over time.

The flaw exists in the generic Linux kernel, specifically within the DRM gpusvm component used for GPU virtualization. No specific kernel versions or product variants are listed in the CNA data, so all builds containing the affected driver source may be impacted until the fix is applied.

The CVSS score is 5.5, and the EPSS score is < 1%. Based on the description, the likely attack vector requires inducing a failure in kvmalloc_array(), which is not an arbitrary remote attack vector. Exploitation would likely require an environment that can trigger such allocation failures, for example, sustained stress on GPU memory allocation. Without a patch, the reference leak could slowly exhaust kernel resources and lead to system instability or crash, but no documented active exploits exist and the case is not listed in CISA’s KEV catalog.