The issue arises in the Linux kernel's AMDGPU DRM driver, where JPEG control streams containing 64-bit user fences could be accepted even though the JPEG v4.0.5 ring does not support them. This improper input validation (CWE-20) and inadequate restriction of vector operations within buffer bounds (CWE-229) can cause the driver to mis-handle the stream, potentially leading to GPU resource corruption or a crash. The description implies that the vulnerability could produce driver instability or service interruption.

Any Linux system using the AMDGPU DRM driver for the JPEG v4.0.5 ring without the no_user_fence protection is affected. This includes all kernel releases that do not contain the patch which adds the no_user_fence check.

The vulnerability scores a CVSS of 7.8, indicating high severity, while the EPSS score of less than 1% suggests exploitation attempts are rare. It is not listed in the CISA KEV catalogue, indicating no widespread operational incidents. The weakness seems to require local access to the kernel’s GPU driver and the ability to inject a JPEG control stream containing a user fence; thus the attack vector is local and does not provide privilege escalation or remote execution.