A defect in the DRM gpusvm driver causes the dpagemap structure to be initialized only after a successful mapping. When a later page mapping fails, the error path skips unmap operations because the mapping information was never stored, resulting in device mappings that remain active. This defect can lead to unintended exposure of GPU memory, allowing the reading or manipulation of data that should be protected.

Linux kernel versions prior to the three committed patches (72e4fca, 7f708f5, e836252) are impacted. Distributions shipping the vanilla kernel before these commits, including mainstream releases, are therefore vulnerable in the DRM gpusvm subsystem.

The CVSS score of 8.8 indicates high severity, and the EPSS score is less than 1%. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploitation requires kernel or root privileges, limiting the attack surface to privileged users or compromised kernel components. Although an unprivileged external attacker is unlikely to exploit this flaw, a compromised or privileged attacker could read or write GPU memory, potentially exposing confidential data or enabling further kernel‑level attacks.