A NULL pointer dereference occurs in the Linux GPU driver, which can trigger a kernel crash and result in a denial of service. The weakness is a classic null dereference (CWE‑476) that compromises system availability when executed.

The flaw affects a broad range of AMD products, including all AMD Athlon 3000 Series Mobile Processors, EPYC 4004 and 4005 series processors, the Instinct MI210, MI250, MI250X, MI300A, MI300X, MI308X, MI325X, MI350X, MI355X, and the AMD Radeon AI PRO R9000, Radeon PRO V620, V710, W5000, W6000, W7000, RX 5000, RX 6000, RX 7000, RX 9000 series graphics cards, and numerous Ryzen 4000, 5000, 6000, 7000, 7020, 7030, 7035, 7040, 7045, 8000, 8040, 9000, 9000HX, AI 300, AI 400, AI Max 300 and AI Max 400 series processors. Specific affected versions are not listed in the advisory.

The CVSS score of 6.9 indicates a moderate severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to require local execution privileges on a system that has the vulnerable Linux GPU driver loaded; an attacker with sufficient privilege could trigger the crash and disrupt availability, but details of remote exploitation are not provided.