Technical impact
The flaw in the AMD DRM display subsystem allows a null pointer dereference when handling LVDS connectors. If the system processes LVDS configuration data that contains an invalid or missing "ext_caps" pointer, the kernel will attempt to access memory through the pointer and crash, resulting in a denial‑of‑service on the host. This type of fault can cause the operating system to reboot or become unresponsive, but does not directly grant an attacker privileged code execution or data disclosure. Based on the description, it is inferred that the likely attack vector is local, requiring a user or process to supply malformed LVDS configuration data to trigger the null pointer dereference.
Affected Systems
The vulnerability affects the generic Linux kernel, specifically the drm/amd/display code path used by AMD graphics drivers on systems that support LVDS displays. Because the CNA does not list specific kernel versions, any instance of the kernel that has not incorporated the security‑fix commit is potentially vulnerable. Users running older kernels or custom builds that omit this patch may be impacted.
Risk and Exploitability
An EPSS score of less than 1% indicates a very low but nonzero probability of exploit, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation in the wild. Consequently, the formal risk rating is still low to moderate based on the severity of a kernel crash. If the device driver accepts LVDS configuration data from user space or from external interfaces, a local attacker could craft malicious input to trigger the exception. The vulnerability has been addressed in a kernel commit; systems that have not applied the patch may want to evaluate the attack surface or rely on the patch to mitigate the issue.
