The flaw stems from the AMDGPU driver’s JPEG ring incorrectly handling 64‑bit user‑fence writes. By allowing these writes, the driver can misinterpret or corrupt the GPU command stream which results in the GPU scheduler rejecting the stream or the kernel panicking. Because the flaw exists in the kernel’s JPEG ring code, a crafted command stream can be delivered by a local or privileged application, causing the system to become unavailable. This manifests as a denial of service affecting GPU‑dependent functionality.

All Linux kernel releases that contain the AMDGPU driver before the commit that disables 64‑bit user‑fence writes are susceptible. Distributions that ship those kernels—including Ubuntu LTS, Fedora, Debian, Arch, and others—remain at risk if they have not applied the kernel update. The issue is confined to AMDGPU GPUs; systems without the driver or with non‑AMD GPUs are unaffected.

The CVSS score of 7.8 classifies the issue as high severity. EPSS indicates an exploitation probability of less than 1 %, and the vulnerability is not listed in CISA KEV, suggesting no widely‑publicized exploits. Since the flaw requires injection of a malformed command stream into the GPU and can only be executed by software interacting with the JPEG ring, the attack surface is primarily local or requires elevated privileges. The safest mitigation remains applying the patched kernel; meanwhile, monitoring logs for GPU errors can help detect any attempts to trigger the fault.