The flaw occurs because the AMDGPU driver reserves a 64‑KB trap area but allocates only 8‑KB when the kernel page size is 64‑KB, causing a null pointer dereference during GPU memory allocation. When a process triggers an amdgpu ioctl that performs this allocation, the kernel crashes, emitting an Oops and requiring a reboot. The result is a denial of service that disrupts normal GPU‑related operations such as running rocminfo or unit tests.

This vulnerability affects the Linux kernel’s amdgpu driver in builds that define AMDGPU_VA_RESERVED_TRAP_SIZE as 8‑KB and run on architectures supporting 64‑KB pages, notably POWER10 machines. It was observed in the 6.19.0‑rc4 kernel before the commit that aligns the reserved size with the page size, so any kernel version lacking that patch is susceptible.

The defect can be triggered by any local process that issues the relevant amdgpu ioctl, so privilege escalation is not required. The expected attack vector is a local user invoking GPU utilities such as rocminfo, which internally call the affected ioctl. Because the attack only causes a kernel crash, the conditions are straightforward and the likelihood of in‑the‑wild exploitation is low; the EPSS score of <1% confirms this low probability. The CVSS score of 5.5 indicates a moderate severity, and the vulnerability is not listed in CISA KEV. The impact is a kernel crash that results in a denial of service.