The Linux kernel’s DRM/amdgpu driver contains a flaw in the VCN v3.0 encoder and decoder rings. The driver does not correctly process 64‑bit user fence writes, causing it to reject command‑submission packets that include such fences. As a result, any GPU workload that relies on 64‑bit user fences cannot be executed, effectively denying the affected GPU services. The vulnerability is identified as CWE‑1287 and CWE‑20, leading to a service‑availability impact rather than privilege escalation or data disclosure.

All Linux kernel installations that include the unpatched amdgpu driver with VCN v3.0 rings are vulnerable. The CVE data lists the Linux kernel 7.1 release candidate (7.1 rc1) as affected, in addition to any kernel version that does not contain commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614. Distributors should confirm that their kernel or driver package incorporates this commit or the 7.1 rc1 baseline before allowing user workloads that depend on the affected rings.

The CVSS score of 7.8 indicates a high severity denial‑of‑service condition. The EPSS value of < 1 % signals a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged code that can submit command‑submission packets containing 64‑bit user fences to the VCN rings; a remote attacker would need such local or privileged access to exploit this weakness. Consequently, the overall exploitation risk is low for remote attackers but would be higher for systems where local code can manipulate GPU submissions.