The Linux kernel DRM/xe subsystem contains a bug in xe_vm_create where a failure to allocate a reserved object causes xe_svm_init to run unconditionally while the corresponding cleanup function xe_svm_fini is only executed for fault‑mode VMs. As a result, the GPU virtual memory manager and, for fault‑mode VMs, the pagemap owner and pagemaps remain allocated, producing a leak in kernel memory and GPU resources. This flaw corresponds to CWE‑772, a resource‑leak weakness, which could lead to denial‑of‑service if resources are exhausted.

All Linux kernel releases using the generic drm/xe drivers that contain the unpatched code, covering every distribution that ships a standard Linux kernel prior to the commit that introduces the fix.

The EPSS score indicates lower than 1% probability of exploitation. The CVSS score of 7.8 signals high severity. Based on the description, it is inferred that the leak could allow a local or privileged attacker to exhaust GPU memory or pagemap resources, potentially resulting in denial of service. The flaw resides in kernel space, representing a local‑privilege or privilege‑escalation risk if an attacker can create GPU virtual machines.