The vulnerability involves improper handling of PCI device reference counts during the amd_smn_init() initialization in the Linux kernel. A temporary root pointer used in the PCI device search was not correctly decremented, leading to stale reference counts. Additionally, the code unnecessarily reset the root pointer before a second search loop. These issues could result in memory leaks, kernel instability, or potential kernel panics due to dangling references.

The flaw resides in the Linux kernel’s x86 AMD node code. Because the affected code path exists in all kernel builds that include amd_smn_init(), any system running a kernel version without the fix may be vulnerable. Vendor and version details are not explicitly listed, so all pre‑fix kernel releases are potentially impacted until the patch is applied.

The CVSS score is not provided, and the EPSS score is unknown. The flaw is not listed in the CISA KEV catalog. The likely attack vector is local root or privileged code execution that can trigger the device initialization routine, such as during boot or when loading drivers. If exploited, the improper reference counting could lead to memory corruption, kernel crashes, or denial of service. Given the kernel privilege implications, the risk is considered high for affected installations.