The Linux kernel DRM/xe subsystem contains a bug in xe_vm_create where a failure to allocate a reserved object causes xe_svm_init to run unconditionally while the corresponding cleanup function xe_svm_fini is only executed for fault‑mode VMs. As a result, the GPU virtual memory manager and, for fault‑mode VMs, the pagemap owner and pagemaps remain allocated, producing a leak in kernel memory and GPU resources. This flaw corresponds to CWE‑772 and CWE‑401, both resource‑leak weaknesses, which could lead to denial‑of‑service if resources are exhausted.

All Linux kernel releases using the generic drm/xe drivers that contain the unpatched code, covering every distribution that ships a standard Linux kernel prior to the commit that introduces the fix.

The EPSS score indicates lower than 1% probability of exploitation. The CVSS score of 7.8 signals high severity. Based on the description, it is inferred that the leak could allow a local or privileged attacker to exhaust GPU memory or pagemap resources, potentially resulting in denial of service. The flaw resides in kernel space, representing a local‑privilege or privilege‑escalation risk if an attacker can create GPU virtual machines.