The Linux kernel's drm/nouveau driver had a resource leak vulnerability (CVE-2026-52904) caused by improper error handling during PCI device probing. Specifically, when aperture_remove_conflicting_pci_devices() fails, the error path returned without calling nvkm_device_del(), leaking the nvkm_device and pci_enable_device() reference. This leak was introduced after removing an intermediate nvkm_device_del() call. The issue affects multiple linux-hwe-edge kernel versions prior to 7.0.0-27.27 and related builds. The vulnerability is classified as CWE-401 (memory leak). A patch is available and included in Ubuntu kernel updates. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

The vulnerability causes a memory/resource leak in the kernel's GPU driver subsystem, potentially leading to degraded system availability or denial of service due to resource exhaustion. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and no user interaction. No known exploits are reported in the wild.

An official patch is available and included in updated Linux kernel packages for affected Ubuntu releases. Users should apply the kernel updates and reboot their systems to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation is necessary beyond applying the vendor-provided updates.