A null pointer dereference occurs in the Amdgpu driver’s amdgpu_gmc_filter_faults_remove function on AMD APUs such as Raven and Renoir. The bug is triggered when retry faults are enabled (noretry=0) and the code path attempts to read a timestamp from an uninitialized interrupt ring buffer. The resulting crash manifests as a kernel BUG and can bring the entire system down, effectively a denial of service.

The flaw exists in the Linux kernel’s amdgpu driver for all kernel releases that include the unpatched code, particularly the 6.19 release series and its release candidates. It affects systems running AMD APUs that do not initialize secondary interrupt rings, specifically Raven and Renoir families. Any system using the default amdgpu configuration with retry faults enabled on those APUs is impacted.

The CVSS score of 5.5 indicates a medium impact, with an EPSS score of less than 1 % reflecting low expected exploitation probability. It is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The attack path requires kernel execution on a system with the affected hardware and driver; once triggered it causes a crash. The risk is moderate, but the low exploitation likelihood makes it less of an immediate threat than high‑impact remote exploits.