A null pointer dereference occurs when the AMD GPU driver operates without atomic support, causing the kernel to panic. The defect can be triggered by sending a crafted DRM request that forces the driver to use the wrong framebuffer pointer, leading to a system‑wide denial of service. The most likely attack vector is local or privileged access to the DRM subsystem, which would allow an attacker to trigger the crash by interacting with the faulty driver. Based on the description, it is inferred that such a crafted request and local/privileged access are required for exploitation.

The vulnerability resides in the Linux kernel’s DRM subsystem for AMD GPUs. All kernel releases that contain the buggy code before the patch commit 2f2a72de673513247cd6fae14e53f6c40c5841ef are affected, including current mainline versions and downstream distributions that have not applied the fix. Once the kernel includes the commit, the flaw is mitigated.

The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. Because an attacker would need to interact with the DRM subsystem—usually requiring local or privileged access—the overall risk to typical deployments is low, though environments with elevated privilege concerns should address the problem promptly. Based on the description, it is inferred that such access is necessary for exploitation.