In the Linux kernel’s Xen grant device driver, the ioctl used to map a grant reference does not properly free a reference when an error occurs after the mapping has been added to the linked list. The reference allocated by gntdev_alloc_map() remains held and the entry stays in the private map list with a refcount of one, resulting in a memory leak. If copy_to_user() fails, the entry remains dangling. Repeated failures to map a grant can therefore steadily consume kernel memory, eventually exhausting resources and potentially bringing the system to a denial‑of‑service state.

The flaw affects the Linux kernel within the xen/gntdev subsystem. All kernel releases that contain Xen grant support and predate the commit that adds the missing reference release and correct index handling are vulnerable. The vendor is the Linux kernel community; any system running an unpatched kernel with Xen grant support is impacted.

CVSS score 5.5 reflects a moderate severity. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a local user with sufficient privileges to invoke the gntdev_ioctl_map_grant_ref() ioctl, such as a process running as root or a privileged guest. The attacker would trigger the ioctl in a failure path; each failure gradually leaks memory. While this does not allow arbitrary code execution, repeated exploitation could deplete resources and destabilize the host. Because the vulnerability does not require remote code execution or network interaction, the overall risk is moderate and best mitigated by applying the patch.