The bug resides in the Linux kernel’s accel/rocket driver where rocket_job_run() mishandles DMA fence references and runtime power‑management counters on error. It leaves a fence reference unreleased, increments the runtime PM usage counter without a matching decrement, and returns an unsignaled fence to the DRM scheduler. These issues can lead to resource exhaustion, warn the scheduler, and prevent the NVIDIA Processing Unit from suspending, compromising system stability and power management.

The vulnerability impacts any Linux kernel release that contains the accel/rocket driver before the commit that replaces pm_runtime_get_sync with pm_runtime_resume_and_get. No specific version numbers are listed, so any kernel embedding the buggy code path referenced in the commit URLs is vulnerable.

The CVSS score of 4.7 indicates medium severity. EPSS score of < 1% indicates a very low, but non-zero, likelihood of exploitation, and the flaw is not in the CISA KEV catalog. Because the issue is kernel-level, an attacker would need local root or kernel‑mode code execution; no remote exploitation path is described, limiting overall risk.