The vulnerability arises from the AMDGPU driver’s JPEG ring incorrectly handling 64‑bit user fence writes. The issue exemplifies CWE‑1287, CWE‑20, and CWE‑754. When such writes are attempted, the ring rejects the command stream or the kernel can panic, interrupting GPU‑dependent functionality.

Linux kernels that contain the AMDGPU driver before the commit that disables 64‑bit user‑fence writes are vulnerable. The issue is limited to systems using the AMDGPU driver; systems without the driver or with non‑AMD GPUs are unaffected.

The CVSS score of 7.8 categorizes the issue as high severity. With an EPSS score below 1 % and no presence in the CISA KEV catalog, no widely known exploits are documented. Exploitation would require injection of a malformed command stream into the AMDGPU JPEG ring, which is typically only possible from software executing with local or elevated privileges. The attack surface is therefore primarily local, and the vulnerability was fixed by the kernel commit that omitted 64‑bit user‑fence support.