A defect in the Linux kernel's vmwgfx DRM driver causes a dma_buf reference to remain held when a renderD client attempts to import a foreign file descriptor and the operation fails. The error path does not release the reference, so each failed import permanently pins the foreign exporter’s GEM resources. An attacker can repeat this fault, leaking one reference per call and leading to unbounded consumption of GEM memory, which may culminate in a denial of service to the rendering subsystem or the entire system.

The flaw impacts the Linux kernel’s vmwgfx module, used in virtualized and GPU‑accelerated environments. All kernel releases that contain this module and have not yet been patched are potentially vulnerable; no specific version range is provided. The issue applies to the kernel as a whole, so every installation that uses vmwgfx prior to the fix is at risk.

No CVSS score or EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low exploitation probability. The attack requires a local renderD client capable of sending a prime file descriptor to the vmwgfx driver, thus it is a local privilege or process boundary attack rather than a remote vector. While exploitation is straightforward once conditions are met, the impact becomes significant only if many such clients can repeatedly trigger the leak.