The vulnerability arises in the Linux kernel’s virtio GPU driver, where an error in drm_gem_handle_create() causes an object reference not to be released. This leaves shared memory pages, scatter‑gather tables, and GPU object structures unreleased, resulting in a memory and resource leak on the host. Once the host‑side resource and identifier are also not cleaned up, repeated failures can exhaust memory, degrade performance, or cause a denial of service. The flaw pertains to improper reference counting and resource cleanup – a classic resource‑leak weakness.

Linux kernel deployments that expose the virtio‑GPU (i.e., virtual machines or containers utilizing GPU passthrough or virtual GPU devices). Versions prior to the fix contained the issue; no specific version list is supplied, so all kernels before the commit that introduced the patch are considered affected.

The flaw is a kernel‑level resource leak; it does not enable code execution or privilege escalation directly, but it can be exploited by repeatedly triggering the failure path to drain system memory and disrupt services. The CVSS score is 2.5, indicating low severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so the immediate threat level is uncertain. However, because the defect occurs within the kernel’s graphics subsystem, it is potentially exploitable on systems that actively use virtio‑GPU devices, warranting patching or mitigation.