The kernel’s AMDGPU buffer object creation routine increments a pin counter each time it is called with a non‑NULL pointer, yet the corresponding unpin operation only decrements it once. This mismatch allows the pin count to grow indefinitely, preventing the TTM memory manager from moving, swapping or evicting the affected buffer objects. The result is a leaking of kernel‑side buffers that can eventually consume all available memory and degrade system performance or cause failures.

All Linux kernel installations that use the AMDGPU driver are potentially affected. No specific kernel versions are listed, so the issue may exist in any release that has not applied the commit that corrects the reference counting logic.

The vulnerability is not catalogued in CISA’s KEV list and the EPSS score of <1% indicates a low yet non‑zero exploitation probability. The CVSS score of 5.5 reflects a moderate severity. Exploitation requires privileged code to perform repeated calls to the driver routine that occurs during firmware reloads or resume operations; it is therefore unlikely to be exploitable remotely without kernel compromise. The risk is judged moderate, primarily to the integrity and availability of memory resources within the affected systems.