The vulnerability resides in the Linux kernel’s AMDGPU driver for the VCN component and involves the handling of 64‑bit user fences in the encoder ring. When a command stream attempts to write a 64‑bit fence, the driver rejects the submission and leaves the ring idle, effectively stopping GPU‑based video encoding or decoding. The weakness is classified as CWE‑229, indicating improper handling of data structures that can lead to erroneous behavior. The impact is a loss of functionality for any workload that relies on these fences, but it does not expose data or enable privilege escalation.

All instances of the Linux kernel that include the AMDGPU driver with VCN version 4.0.5 are affected. The flaw appears in the drm/amdgpu/vcn driver path, so any kernel built with that component and lacking the patch disabling 64‑bit fences is vulnerable.

The CVSS score of 7.8 marks the issue as high severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not present in CISA’s KEV catalog. The CVE description does not specify an explicit attack vector; the likely vector is a local user who can construct a command stream containing a 64‑bit fence. This inference is based on the description that the failure occurs on user‑supplied command data. Exploitation would cause a denial of service for video workloads but does not provide broader system compromise.