Technical impact
The vulnerability resides in the AMDGPU command submission parser within the Linux kernel. It involves a resource management flaw (CWE‑772). During low‑memory situations, a kmalloc failure can occur, causing the parser to exit without unlocking its mutex, which can lead to a deadlock or kernel hang. The supplied patch removes an unnecessary reference to the buffer‑object list and ensures the mutex is released on allocation failure, preventing the deadlock scenario.
Affected Systems
Systems that run a Linux kernel with the AMDGPU driver and contain the legacy amdgpu_cs_parser_bos code path are affected. The CVE does not specify a particular kernel version, so any kernel that implements the old path could be impacted until the patch is applied.
Risk and Exploitability
The CVSS score of 5.5 indicates a medium severity vulnerability, while the EPSS score of < 1% suggests a very low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a low‑memory condition and affects only internal kernel structures, making the practical risk low to moderate. The primary concern is system stability rather than direct security compromise.
