The vulnerability resides in the Linux kernel’s AMDGPU driver for the VCN component and stems from how it handles 64‑bit user fences in the encoder ring. When a command stream attempts to write a 64‑bit fence, the driver rejects the submission and leaves the ring idle, effectively stopping GPU‑based video encoding or decoding. This flaw is classified as CWE‑20, indicating improper handling of user input data and data structure operations, and results in a functional loss for workloads that rely on these fences; it does not expose data or enable privilege escalation.

All instances of the Linux kernel that include the AMDGPU driver with VCN version 4.0.5 are affected. The flaw appears in the drm/amdgpu/vcn driver code, so any kernel built with that component and lacking the disabling patch will reject 64‑bit fences written by users, impacting GPU video workloads across the system.

The CVSS score of 7.8 marks the issue as high severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not present in CISA’s KEV catalog. Based on the description that the failure occurs on user‑supplied command data, the likely attack vector is a local user or process that can construct a command stream containing a 64‑bit fence. Exploitation would trigger a denial of service for video workloads but does not grant broader system compromise.