The virtio GPU driver in the Linux kernel contains a flaw in virtio_gpu_resource_create_blob_ioctl() where it releases a reference on error paths using drm_gem_object_release() instead of dropping the reference it owns, causing obj->funcs->free() never to run. The virtio_gpu_object, the resource identifier, and the host‑side resource are leaked, potentially building up unbounded kernel memory consumption and resource exhaustion. This vulnerability represents an improper release of resources weakness (CWE-772).

Any Linux kernel that implements the virtio GPU DRM subsystem without the fix remains vulnerable. This includes mainstream distributions running a kernel that predates the commit adding drm_gem_object_put(), particularly in environments that provide virtio GPU devices to user‑space applications or virtual machines.

The vulnerability has a published CVSS score of 3.3, indicating low severity, and an EPSS score of < 1%, implying a very low probability of exploitation. It is not listed in CISA KEV. The accumulation of leaked resources can lead to denial of service. The likely attack vector is an attacker with ability to invoke the ioctl, such as a privileged user or a malicious virtual machine granted access to the virtio GPU device, which can deliberately trigger the error condition and exhaust kernel memory over time.