The vulnerability is a reference leak in the Linux kernel Nouveau DRM driver. When ttm_bo_reserve() fails or a VMA lookup fails the driver exits a validation loop without releasing the reference taken by drm_gem_object_lookup(), creating a kernel‐mode memory leak. Repeated failures can consume available kernel memory and may eventually cause system instability or a crash.

This bug affects Linux kernel installations that use the open‑source Nouveau DRM driver. All distributions that ship the driver, such as Ubuntu, Debian, Fedora, and CentOS, may be impacted if their kernel has not been updated to include the commit that closes the reference leak. No specific kernel versions are listed in the advisory.

Based on the description, the likely attack vector is a local process that repeatedly triggers ttm_bo_reserve() failures or VMA not found errors. The CVE lacks a CVSS and EPSS score and is not listed in CISA KEV, indicating that no publicly known exploitation technique is documented. The impact appears limited to memory exhaustion; an attacker would need a privileged or untrusted process capable of inducing many GPU allocation failures, suggesting a lower‑to‑medium likelihood of exploitation in typical environments. The risk is highest for systems that use the Nouveau driver with workloads that can force allocation errors or that run in memory‑constrained contexts.