The amdgpu driver allocates an IP hardware instance and embeds a kobject during device initialization. If the kobject_add() call fails, the error is ignored and the initial reference is left unreleased. As a result, the ip_hw_instance_release() routine is never invoked and the memory allocated for the instance leaks into the kernel's data segment.

The vulnerability affects the amdgpu graphics driver within the Linux kernel. No specific kernel release or version range is listed, so versions containing the unpatched amdgpu code prior to the described commit may be impacted.

This is a local kernel error; there is no known external trigger to force the failure path. The CVSS score is 1.9 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation in the wild is uncertain. The risk arises from the accumulation of leaked memory over time, potentially exhausting system resources and degrading kernel stability or availability.