The vulnerability resides in the AMDGPU driver’s handling of the JPEG ring within the Linux kernel. It causes the kernel to reject JPEG command submissions that include 64‑bit user fence writes because the ring class does not support this operation. The resulting rejection prevents JPEG decoding from completing, effectively disabling JPEG processing for applications that rely on hardware acceleration. This flaw is classified as CWE‑1287, reflecting improper handling of user‑supplied data in a low‑level kernel component.

All Linux kernel releases that ship the AMDGPU driver with JPEG ring support and have not incorporated commit 8d0cac94 are affected. This includes most mainstream Linux distributions that use the generic kernel for AMD graphics hardware. Devices running older kernels lacking the patch will experience failures when JPEG decoding is attempted through the GPU hardware acceleration path.

The CVSS score of 7.8 indicates a high severity that can disrupt services, while the EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, further indicating that no known active exploits exist. Based on the description, it is inferred that attackers would need local access—specifically, a user‑level JPEG application that submits commands featuring a user fence—to trigger the failure. An attacker could repeatedly provoke JPEG decoding errors to degrade application availability, but the flaw does not provide privilege escalation or data exposure.