Huge user input values supplied to the AMDGPU wait ioctl can trigger an out‑of‑memory condition, causing the kernel to abort and bring the whole system down. The underlying flaw is a lack of an upper bound on the number of handles processed, allowing an attacker to exhaust memory and deny service to all users. The attack does not expose data or privilege but induces a crash that renders the host unusable until reboot.

All Linux kernel releases that include the amdgpu driver are affected until the fix is applied. The vulnerability exists in the kernel module that implements the amdgpu_userq_wait_ioctl interface. No specific distribution version is listed; any system running a kernel that bundles the patched amdgpu code before the commit fcec012c664247531aed3e662f4280ff804d1476 is at risk.

The CVSS score is not provided and the EPSS entry is not available, but the absence from the KEV catalog does not diminish the potential impact. The flaw can be exercised from user space by sending a crafted ioctl to the DRM device (e.g., /dev/dri/card*), making it a local privilege exploitation vector. An attacker with access to the device – typically any regular user – can trigger the crash. The exploit complexity is low; no advanced prerequisites are mentioned beyond the access to the GPU device.