A flaw in the AMDGPU driver’s handling of GPU timeline fences can cause a reference count underflow, leading to a use‑after‑free of a dma_fence object. The faulty reference is taken too early and is not released properly when the virtual address mapping operation finishes, allowing the kernel to dereference freed memory and crash. This results in a kernel panic and complete loss of service.

All Linux kernel releases that include the legacy AMDGPU driver before the inclusion of commit 0399b8416ecf64ef86ad23401fe23eabdb07831a. The affected vendor is Linux and the product is the Linux kernel. No specific version range is provided; the patch is known to appear after that commit.

The CVSS score and EPSS rating are not available, but the failure to manage reference counting leads to a critical kernel panic. While the description does not explicitly state the attack vector, it is inferred that the flaw can be triggered by invoking the DRM ioctl operation, which requires local access to /dev/dri/* devices. Because the defect is triggered by normal user‑space operations, a user with such access can execute the attack. Given the lack of remote execution and the necessity for local access, the overall risk is considered high for systems exposed to untrusted users that run applications that exercise DRM video mapping. The vulnerability is not currently listed in the CISA KEV catalog, but the potential for a system‑wide denial of service warrants immediate action.