The flaw resides in the AMDGPU driver’s job submission routine, where a fence object is released before the driver waits for job completion. If the last reference to the fence is dropped too early, the underlying memory block may be freed, leading to a use‑after‑free during the subsequent wait call. This flaw qualifies as a CWE‑416 Use‑After‑Free vulnerability, primarily impacting system stability and integrity rather than exposing data to remote actors.

All Linux kernel releases that ship the full AMDGPU stack are affected, including kernel 6.0 and all 7.0 release candidates (RC1 through RC7). The bug is present in the amdgpu_amdkfd.c source within the DRM subsystem, so any system running an unpatched AMDGPU driver on a supported kernel is vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS probability is below 1% and the issue is not listed in the CISA KEV catalog, suggesting no known active exploits. The flaw is a classic CWE‑416 Use‑After‑Free vulnerability. Because the flaw involves a kernel driver routine that could be triggered by localized GPU job submission, the exploitation would likely require local interaction. With no publicly disclosed exploits and low EPSS, the risk of exploitation is limited, but the potential impact on kernel stability warrants applying the patch.