The amdgpu command submission parser allocates a host memory mapping (HMM) range for each user pointer (userptr) entry in a buffer object list but fails to free those ranges on certain error paths in amdgpu_cs_patch_jobs, amdgpu_cs_vm_handling, amdgpu_cs_sync_rings, or the early part of amdgpu_cs_submit. Consequently each failed command submission leaks the HMM range, the per‑page address array, and associated buffer object references, causing a kernel‑space memory/resource leak. Repeated exploitation can deplete kernel memory, potentially leading to system instability or denial of service.

Affected systems are Linux kernel releases that include the amdgpu driver before the patch containing commit c52a9542. This includes most distributions running older kernels with an unpatched amdgpu driver. The vulnerability is not tied to a specific vendor beyond the Linux kernel itself, and any system using the affected driver version is susceptible.

The CVE is not listed in the CISA KEV catalog and the EPSS score is not available, indicating no publicly known exploitation at this time. The vulnerability requires a local user to submit many failing command buffers that trigger the specific error paths, so the risk is considered low to moderate under standard operating conditions. However, because the leak accumulates kernel memory, a kernel administrator could deliberately induce the failure repeatedly to exhaust memory and cause a denial of service.