The vulnerability in the AMDGPU driver causes a memory leak when an amdgpu_hmm_range_alloc() call fails with an ENOMEM error. amdgpu_gem_userptr_ioctl() returns -ENOMEM immediately but does not remove the partially allocated GEM object, its parent reference on the VM root, or its MMU notifier registration. This leaves stale objects that consume kernel memory and can lead to a gradual exhaustion of the graphics memory subsystem.

Affected systems are Linux distributions that ship the upstream Linux kernel with the AMDGPU graphics driver and that enable the userptr ioctl interface. The problem affects all kernel versions where the bug exists before the patch commit bbe739e407a542073ec1a7872b14843566b4919e is applied. Vendor information shows only Linux:Linux per CNA, indicating an upstream kernel vulnerability rather than a specific vendor patch.

Because the bug is triggered only when a memory allocation fails during a userptr ioctl request, an attacker would need to repeatedly invoke this ioctl under low memory conditions. The resulting resource exhaustion could cause the kernel to throttle or OOM‑kill processes, potentially allowing a local attacker to disrupt graphics workloads or trigger a denial of service. No exploitation is in the CISA KEV list and EPSS data is not available, suggesting that public exploitation is limited; however, the low complexity of triggering a resource leak means the risk remains non‑negligible for exposed systems.