The vulnerability in the Linux kernel’s AMD GPU driver allows the VCN poison interrupt handler to be skipped when a virtual function (VF) is deactivated. This causes the driver to attempt to release a resource that was never initialized, producing an invalid call trace and resulting in a kernel panic. The impact is a loss of availability: a crash of the entire system or at least the affected virtual machine. No unauthorized data disclosure or integrity compromise is reported, but the crash may be leveraged for disruption. The underlying weakness is improper resource cleanup (CWE-832).

All Linux kernel users that load the amdgpu module with a Virtual Function enabled are affected. The vendor information identifies the product as the Linux kernel; specific version data are not supplied, but the fix has been applied in recent kernel releases. Until the patch is deployed, any deployment using the amdgpu driver with VCNv2.5 and VF support is vulnerable.

The CVSS score is not listed, and EPSS data are unavailable, but the bug exhibits a typical kernel crash scenario that requires local privileged or kernel module removal privileges to trigger. The KEV catalog does not indicate known exploitation. In practice, an attacker with sufficient permissions to unload or reload the amdgpu module can induce the failure, leading to a denial-of-service attack. The risk is moderate to high for environments that allow module manipulation but low for fully locked down configurations.