The Linux kernel’s host1x GPU driver stored pinned buffer objects (BOs) in a cache that retained a strong reference to each BO. Because the cache prevented the BO reference count from dropping, the object could never be freed once cached. Repeated or malicious pinning therefore caused BOs to accumulate in kernel memory, eventually exhausting available memory or leading to kernel instability. The flaw does not provide an execution path and only affects resource consumption.

All Linux kernel builds that include the host1x GPU driver before the patch are affected. This includes every distribution or custom kernel that incorporates the TegraDRM host1x implementation used for GPU acceleration. The vulnerability is present in any kernel version where the host1x.bo_pin() path allows cache usage without a weak reference.

The CVSS score of 5.5 reflects a moderate severity. The EPSS score of less than 1% indicates a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV, meaning no public exploits have been reported. Based on the description, the attack vector is local: a user process capable of pinning host1x buffers can trigger the BO cache buildup, consuming memory and potentially causing a denial‑of‑service without requiring elevated privileges. The vulnerability is limited to environments where GPU buffer pinning is performed.