The vulnerability resides in the Linux kernel AMDGPU VCN driver not supporting 64-bit user fence writes; any command submission that includes a user fence is rejected. This flaw stops GPU command streams from executing, potentially rendering applications relying on VCN encoding or decoding inoperable, effectively causing a denial of service for those processes. The weakness is a fault in the driver’s handling of user‑provided data, identified as CWE-1287 and CWE-20.

Affected systems are Linux kernel environments that use the AMDGPU VCN driver. All Linux distributions running kernel versions that have not incorporated the fix from commit ff1a5a125c5a70c328806b9bc01d7d942cf3f9aa are vulnerable. The product is Linux kernel; no specific distribution or kernel version list is provided beyond the presence of the VCN encoder ring.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% indicates that exploitation is unlikely and it is not listed in CISA's KEV catalog. A command stream that includes a user fence to the AMDGPU driver would trigger the flaw, but without such capability an attacker cannot exploit the flaw. If an attacker succeeds, the impact is denial of service for GPU‑accelerated workloads on the affected machine. No public exploit is known but the fix is recommended.