A race condition in the Linux kernel’s DRM AMDGPU subsystem allows an attacker to unmap a write‑pointer object while a command queue is still being created, and to substitute a different buffer object at the same physical address. If the attacker can influence these operations, the stale mapping may lead to kernel memory corruption. The description implies that such corruption could enable arbitrary code execution or privilege escalation, but the advisory does not explicitly confirm these outcomes.

This vulnerability is present in the Linux kernel’s AMDGPU subsystem prior to the inclusion of commit 1fc6c8ab. The specific kernel releases without this commit are potentially affected. Systems that have updated to kernels incorporating the fix are no longer vulnerable.

The advisory does not provide a CVSS or EPSS score; however, the race condition is severe and represents a high‑severity kernel flaw. It is not listed in the CISA KEV catalog and no public exploits are documented. Based on the description, it is inferred that the attack vector is local, requiring the attacker to have the ability to generate GPU command queue operations or to influence the AMDGPU driver. The stale mapping window could be leveraged to overwrite critical kernel data structures, posing a significant risk in environments where the driver is exposed to untrusted processes.