The Linux kernel’s DRM/xe component contains a bug where the variable q->replay_state is unconditionally overwritten, causing memory allocated by vmemdup_user to be leaked. This leads to a kernel‑level memory leak that can gradually consume system memory and potentially cause denial of service by exhausting resources. The flaw is local to the kernel and does not provide remote code execution, but it can degrade system availability for any process that interacts with the DRM/xe driver.

Any Linux system that incorporates the DRM/xe driver and has not applied the patch from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e is affected. No specific kernel versions are listed, so the issue applies to all kernels that include the unpatched driver code.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation data. No CVSS score is provided in the data, so the severity remains unspecified. The vulnerability could potentially lead to memory leakage if an attacker can interact with the DRM/xe driver. The attack vector is inferred to be local kernel manipulation rather than remote network access.