The vulnerability arises from a synchronization bug in the amdgpu driver’s handling of dmabuf move notifications. When a buffer object is relocated from one GPU to another, the driver assumes the destination GPU’s page table has been updated immediately, but the update occurs asynchronously. This mis‑sync can cause a race condition where the source GPU still accesses the buffer after it has been moved, potentially resulting in a page fault. The faulty logic is tied to the ticket mechanism controlling the move operation.

The flaw exists in the Linux kernel’s amdgpu driver. No specific kernel version list is provided, so any kernel containing the mentioned code before the reported commit is vulnerable. The issue is relevant on systems running multiple GPUs that share buffer objects, especially when PCIe peer‑to‑peer is not available. Affected vendors count as Linux kernel; vendors of specific distributions are all that ship the kernel with the unpatched amdgpu code.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog. The flaw can lead to a denial of service by causing a page fault that may disrupt rendering or crash the kernel. The attack vector is inferred to be a local user or process that can initiate GPU workloads that trigger buffer moves, as the bug is triggered during normal operation. No public exploit is documented, but the potential for service disruption remains high for affected systems.