The vulnerability enables a userspace application to intentionally trigger kernel warning backtraces through the amdgpu user queue wait ioctl by supplying a num_fences value that is too small or allowing the required count to grow between calls. The kernel’s WARN_ON statements would emit a backtrace, after which userspace receives an errno. The fix removes the WARN_ONs so no warning is emitted, only an error code is returned.

Systems running the Linux kernel with an amdgpu driver that precedes the commit removing the WARN_ONs are potentially affected. The specific kernel releases are not listed, so any kernel before the applied change should be examined.

The EPSS score is below 1 %, and the vulnerability is not in the CISA KEV catalog. Exploitation requires local userspace access to the amdgpu driver and only leads to kernel warning messages, not arbitrary code execution or denial of service. Updating to a patched kernel removes the risk.