The vulnerability is a defensive coding deficiency and an improper handling of 64‑bit user fence writes in the kernel’s AMDGPU driver. The kernel incorrectly sets the no_user_fence flag when a user process writes a 64‑bit value to the JPEG v2.5 ring, which rejects the command batch. This aligns with CWE‑20: Improper Input Validation and causes the GPU to discard the requested task, thereby preventing normal JPEG acceleration. The loss of service is limited to applications that rely on this hardware feature; there is no evidence that the flaw compromises confidentiality or integrity.

All Linux kernel implementations that expose the AMDGPU driver are affected. This includes mainstream distributions that ship the stock kernel, as well as any custom or patched kernels that have not incorporated the commit that fixes no_user_fence handling. No specific version range is listed; the vulnerability applies to any kernel with an unpatched JPEG v2.5 ring.

Based on the description, it is inferred that the likely attack vector is local exploitation where a process can submit GPU command batches to the AMDGPU driver. The CVSS score of 7.8 indicates a high‑impact denial of service risk. The EPSS score is below 1 %, implying that, at the time of this analysis, the likelihood of observed exploitation in the wild is very low. The vulnerability is not present in CISA’s KEV catalog. Because the fault requires submission of a GPU command batch, an attacker would need local access to a process that can interact with the AMDGPU driver; remote exploitation without escalation is not described. Thus the vulnerability represents a moderate‑to‑higher risk to availability on systems where the AMDGPU JPEG ring is used.