The flaw occurs because the AMDGPU driver reserves a 64‑KB trap area but allocates only 8‑KB when the kernel page size is 64‑KB, causing a null pointer dereference during GPU memory allocation. When a process triggers an amdgpu ioctl that performs this allocation, the kernel crashes, emitting an Oops and requiring a reboot. The result is a denial of service that disrupts normal GPU‑related operations such as running rocminfo or unit tests.

This vulnerability affects the Linux kernel’s amdgpu driver in builds that define AMDGPU_VA_RESERVED_TRAP_SIZE as 8‑KB and run on architectures supporting 64‑KB pages, notably POWER10 machines. It was observed in the 6.19.0‑rc4 kernel before the commit that aligns the reserved size with the page size, so any kernel version lacking that patch is susceptible.

The defect can be triggered by any local process that issues the relevant amdgpu ioctl, so privilege escalation is not required. The likely attack vector is a local user invoking GPU utilities such as rocminfo, which internally call the affected ioctl. Because the attack only causes a kernel crash, the exploitable conditions are straightforward and the likelihood of in‑the‑wild exploitation is moderate. EPSS data is not available, the flaw has not been listed in CISA KEV, and no CVSS score is published, but the described impact—an immediate kernel crash—constitutes a serious denial of service path.