The Linux kernel’s amdgpu driver contains a flaw where a userspace application can cause the kernel to emit a WARN_ON warning backtrace via the user queue wait ioctl. By requesting an excessively small number of fences or letting the required number of fences grow between calls, the driver would warn even though the kernel is in a valid state. The fix removes these WARN_ON checks, limiting the observable effect to an errno return value returned to userspace.

Linux kernels that include the amdgpu driver before the commit that removed the WARN_ON checks are affected. Kernel versions from 6.16 and the 7.0 series release candidates through 7.0-rc7 are listed as vulnerable, indicating that any kernel prior to the application of the patch may exhibit the warning behavior.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local userspace access to the amdgpu driver and results only in delivery of kernel warning backtraces, not in code execution or denial of service. The likely attack vector is local userspace interaction with the amdgpu device; the fix removes the warning path and mitigates the issue.