The vulnerability occurs when amdgpu_userq_vm_validate calls drm_exec_fini twice with the same execution object due to an error path in amdgpu_ttm_tt_get_user_pages. Because drm_exec_fini is not idempotent and frees internal structures on the first call, the second call corrupts kernel memory and can trigger a crash, resulting in denial of service.

Affected systems are any Linux distributions running kernel versions that contain the unpatched amdgpu driver code. The exact kernel versions are not listed in the advisory, so any system that has not applied the commit that removed the double call is potentially vulnerable. Distributions using the default kernel or custom build with AMDGPU support may be impacted.

The CVSS score is not provided; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No publicly documented exploits are known. The risk appears limited to accidental or intentional execution of the error path, which requires failures in page mapping during AMDGPU operation. However, because the flaw can cause a kernel panic, the potential impact remains high and warrants immediate patching. No commercial exploitation evidence suggests a low exploitation likelihood, but the absence of a known exploit does not eliminate risk.