The vulnerability is a reference leak in the Nouveau DRM driver of the Linux kernel. When ttm_bo_reserve() fails or a VMA lookup fails the driver exits a validation loop without releasing a reference taken by drm_gem_object_lookup(), creating a kernel‑mode memory leak. Repeated failures can consume available kernel memory. While the advisory does not explicitly state that eventually a crash may occur, it is inferred that persistent memory exhaustion could lead to system instability or a crash.

Linux kernel installations that use the Nouveau DRM driver. All distributions shipping the driver are potentially impacted if their kernel branch has not incorporated the commit that fixes the reference leak, and the advisory does not list any explicit kernel versions.

Based on the description, it is inferred that the likely attack vector is a local process that repeatedly triggers ttm_bo_reserve() failures or VMA not found errors. The CVE has a CVSS score of 3.3, an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog, indicating no publicly known exploits. The impact appears limited to memory exhaustion; an attacker would need a privileged or untrusted process able to induce many GPU allocation failures, which suggests a low‑to‑medium exploitation likelihood in most environments. The risk is higher for systems that rely heavily on the Nouveau driver and operate in memory‑constrained contexts.