The vulnerability is a defensive coding deficiency (CWE-1287) in the Linux kernel’s AMDGPU driver. A 64‑bit user fence write to the JPEG v2.5 ring is rejected because the driver incorrectly sets the no_user_fence flag. This causes the ring to discard the command batch, preventing the GPU from completing the requested task. The effect is a loss of service when applications rely on JPEG acceleration, which can be interpreted as a denial of service to that functionality. No information is available on whether the flaw impacts confidentiality or integrity.

All Linux kernel implementations that expose the AMDGPU driver are affected. This includes mainstream distributions that ship the stock kernel, as well as any custom or patched kernels that have not incorporated the commit that fixes no_user_fence handling. No specific version range is listed; the vulnerability applies to any kernel with an unpatched JPEG v2.5 ring.

The CVSS score of 7.8 indicates a high impact denial of service risk. The EPSS score is below 1 %, implying that, at the time of this analysis, the likelihood of observed exploitation in the wild is very low. The vulnerability is not present in CISA’s KEV catalog. Because the fault requires submission of a GPU command batch, an attacker would need local access to a process that can interact with the AMDGPU driver; remote exploitation without escalation is not described. Thus the vulnerability represents a moderate-to-higher risk to availability on systems where the AMDGPU JPEG ring is used.