A function responsible for re‑pinning buffer objects in the Nouveau driver increments the internal pin count even when the pinning request fails due to domain incompatibility. The caller interprets this as a successful pin and never decrements the count, resulting in an inaccurate pin counter. This state inconsistency triggers a WARN_ON_ONCE in ttm_bo_release, signalling that the driver’s internal state is corrupt but no confirmed crash or exploit has been documented.

All installations of the Linux kernel that ship the Nouveau DRM driver are affected, regardless of distribution. No specific kernel versions are listed in the advisory, so the issue applies to all releases prior to the fix committed to the repository.

The advisory now lists a CVSS score of 5.5, indicating a moderate severity. The EPSS score is < 1%, meaning exploitation likelihood is very low. The vulnerability is local; an attacker must interact with the Nouveau driver, which typically requires privileged access. The bug causes a WARN_ON_ONCE in ttm_bo_release due to an incorrect pin count, indicating internal state inconsistency. Although such a warning may accompany an eventual kernel panic if the issue is repeated, no confirmed evidence of a crash or exploitation has been reported. The CISA KEV database does not list this vulnerability, suggesting that publicly documented exploitation is not yet known.