The defect occurs when the amdgpu ACP driver registers child devices with the multi‑device framework before successfully attaching them to the power domain. If the attach fails or if a reset/clock enable operation times out, only the source cell, resource, and platform‑data allocations are freed; the child platform devices remain registered. This leads to a resource leak that can accumulate over time, eventually exhausting kernel resources and destabilizing the system. The weakness is an improper resource release (CWE‑772).

Linux kernel builds that include the amdgpu DRM driver and its ACP power‑domain integration are affected. The vulnerability applies to any kernel prior to the patch from commit 63da68d6a2279ec945581c990c5a59a5ae8b5560, regardless of architecture but only when the amdgpu module is loaded.

The flaw is local; the attacker must be able to trigger the adverse initialization path, which is inferred that requires root or the ability to induce a power‑domain failure. The CVSS score is 1.9, indicating a low severity. The EPSS score is <1% and the vulnerability is not listed in CISA's KEV catalog. Consequently, the overall risk is limited to affected kernels and to contexts where the attacker can provoke the initialization failure, but the potential for resource exhaustion makes it a serious local denial‑of‑service issue.