The vulnerability relates to the AMDGPU JPEG subsystem in the Linux kernel. JPEG command submission rings do not support 64‑bit user fence writes, and the kernel rejects submissions containing such fences. This behavior can cause valid JPEG command submissions to fail, potentially disrupting image processing operations. The weakness is classified as CWE‑1287 and CWE‑20, reflecting improper handling of critical kernel structures and user‑controlled input.

The issue is present in the Linux kernel in the DRM/amdgpu JPEG subsystem. All kernel releases that include the AMGPU JPEG v2.0 ring without the patch are vulnerable. The patch identified in the commit graph is part of the overall Linux kernel, so any distribution shipping a kernel that does not incorporate commit 96179da0c6b059eb31706a0abe8dd6381c533143 is affected, regardless of the distribution version. System administrators should verify whether the running kernel comes from a distribution that has backported this fix or whether they must manually update to a newer kernel that contains it.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation currently. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, an attacker would need local or privileged kernel access to supply a JPEG command submission containing a 64‑bit user fence, leading to a denial‑of‑service condition as the kernel rejects the submission. Once the patch is applied, the vector is removed because the kernel rejects all 64‑bit fences for the JPEG v2.0 ring.