The vulnerability arises in the Linux kernel AMDGPU JPEG ring when a 64‑bit user fence is written; the ring does not support such fences and rejects command submissions that include them. This flaw, classified as a concurrency defect (CWE‑1287), can repeatedly block JPEG decoding requests, potentially exhausting resources or preventing JPEG processing. The defect does not provide a path to execute arbitrary code or to crash the kernel, but it can disrupt services that rely on GPU‑accelerated JPEG decoding.

All Linux kernel builds that have not incorporated the fix commit—specifically any distribution shipping a kernel version prior to the incorporation of commit 4d7d774f100efb5089c86a1fb8c5bf47c63fc9ef—are affected. Because the issue is present in the kernel source tree, any system using a vulnerable kernel, regardless of distribution, remains at risk.

The CVSS score of 7.8 indicates a moderate severity flaw, and the EPSS score of less than 1% suggests that automated exploitation is unlikely. The description implies that an attacker would need to supply JPEG decoding data that triggers the rejected user fence, typically requiring local privileged access or control over a component that initiates GPU decoding. As no remote exploitation vector is documented and the flaw is confined to kernel‑space JPEG ring handling, the overall risk is primarily a disruptive denial of service rather than a direct code‑execution threat. The CVE is not listed in the CISA KEV catalog.