The Linux kernel’s accel/amdxdna driver contains a flaw in the page‑pinning procedure. When pin_user_pages_fast returns fewer pages than requested, the pages that were successfully pinned are not released, creating a kernel‑level memory leak. The unbalanced reference count for the partially pinned pages can accumulate over time, incrementally reducing available kernel memory. The CVE description confirms that the issue is limited to release omissions; there is no indication that a crash or denial of service results from the leaked pages.

Any Linux kernel build that includes the unpatched accel/amdxdna module is affected. A public enumeration indicates linux_kernel, and the vendor list lists Linux:Linux for both vendor and product, implying all standard Linux kernel distributions that compile this driver without the later commit are vulnerable. Version information is not provided, so any kernel prior to the firmware fix referenced in the commit logs is considered at risk.

The CVSS score of 5.5 denotes moderate severity. The EPSS score of < 1% signals a very low likelihood of exploitation. The vulnerability resides in a kernel routine that requires privileged execution; therefore, the likely attack vector is execution of kernel code, either through a privileged user or via a compromise that achieves kernel execution. The vulnerability is currently not listed in the CISA KEV catalog, indicating no known large‑scale exploitation has been reported.