The flaw is in the Linux kernel’s x86 AMD node code. During amd_smn_init() the code fails to decrement the reference count of a temporary root pointer used in PCI device enumeration. This leads to stale reference counts, potential memory leaks, and more critically kernel instability or crashes. The weakness is a classic use‑after‑free/invalid reference counting problem compounded by uninitialized pointer misuse (CWE‑911).

All systems running a Linux kernel that contains the amd_smn_init() function without the recent fix are affected. This includes every x86‑based kernel prior to the patch that adds automated reference‑count cleaning and correct root‑pointer handling. The change is part of the mainline kernel, so any distribution packaging an unpatched kernel version may be impacted.

The CVSS base score is 5.5, reflecting a moderate severity; the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires executing privileged kernel code or triggering the initialization routine (e.g., during boot or driver load). Because the attack surface is limited to systems with root or kernel module privileges, the risk is low to moderate, but the potential impact remains significant.