This vulnerability involves an unintended retention of a reference to a PCI device within the Nouveau DRM driver. The reference acquired by pci_get_domain_bus_and_slot() is never released after the device’s memory size is read, causing an accumulating reference count. The excessive reference count can prevent proper cleanup of the device and may lead to resource exhaustion or degraded system performance, potentially culminating in a denial‑of‑service scenario if triggered repeatedly.

The flaw is present in the Linux kernel's Nouveau graphics driver before the fix was applied. All Linux kernel versions that ship the Nouveau driver without this patch are affected, including default distributions that ship a stock kernel and use the open‑source graphics stack.

If this vulnerability is exploited, the CVSS score is 2.3, indicating a low severity. The EPSS score remains less than 1%, and it is not included in the CISA KEV catalog, implying limited known exploitation. The likely attack vector is local or privileged access that enables interaction with the DRM subsystem and triggers nv1a_ram_new(). By repeatedly invoking this function or otherwise exhausting the reference count, an attacker could induce resource depletion or require the kernel to perform unnecessary cleanup operations, creating a crash or slowdown. Because the flaw operates entirely within kernel space, it requires a user with access to the graphics subsystem and potentially root privilege, reducing the immediacy of threat for ordinary users.