The AMDGPU driver in the Linux kernel fails to zero‑initialize the GART page tables when allocating buffers. When a single page table entry is written, the GPU TLB may speculatively read uninitialized entries from the same cache line. These stale entries can appear valid, and a later write to another entry in that cache line can cause the GPU to use a garbage page table entry from the TLB. The result is that the GPU may reference incorrect or stale memory, leading to corrupted GPU memory usage or abnormal driver behavior that can destabilize the graphics subsystem.

Linux kernel versions 7.1 rc1 and 7.1 rc2 that include the default AMDGPU driver are affected. The flaw exists until the patch that zero‑initializes the GART table on allocation is applied, meaning all distributions shipping these kernels without the fix are vulnerable.

The vulnerability is rated with a CVSS score of 8.8, classifying it as high severity. Its EPSS score is stated as less than 1%, indicating a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Inferred from the description, an attacker would need local or privileged access to the host in order to allocate GPU buffers and trigger the speculative TLB behavior. With such access, exploitation could cause GPU memory corruption, device instability, or denial of service.