The Linux kernel’s amdgpu driver fails to unmap an I/O memory region when a device is removed or the driver module is unloaded. The removal path calls drm_dev_unplug before the mapping is released, leaving one instance of the BAR mapping in kernel space each time. This results in a kernel‑space memory leak that can accumulate with repeated device removals or module unloads. If the leak grows large enough it could exhaust kernel virtual memory, potentially leading to a denial of service. The weakness is identified as a resource leak (CWE-772).

All Linux kernel releases that ship with the amdgpu driver and have not yet incorporated the commit dd6f86a97260e5207d3329ad03aa89fdad61b1e6 are affected. The issue surfaces when a supported AMDGPU device is removed or the driver module is unloaded via hot‑unplug or rmmod, regardless of distribution vendor. The vulnerability is a kernel‑level flaw that manifests during device removal and is not tied to user‑mode operations.

The flaw does not provide a remote or authenticated execution vector; it requires local kernel access. Based on the description it is inferred that repeated removal of the device or repeated module unload is necessary to allow the memory leak to accumulate. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, giving an overall risk that is moderate. The CVSS score of 5.5 indicates moderate severity; however, the potential for kernel memory exhaustion could raise availability impact if the device is unplugged frequently.