The vulnerability exists in the AMDGPU DRM module of the Linux kernel. A race condition in the notifier sequence handling for amdgpu_hmm_range_get_pages allows the sequence to be read more than once, resulting in operations on invalid memory pages. This can corrupt kernel memory and cause instability or crashes, consistent with a kernel memory corruption flaw (CWE‑362).

Affected systems are any Linux kernel installations that include the AMDGPU driver prior to the commit c08972f555945cda57b0adb72272a37910153390. This encompasses generic Linux distributions that ship a kernel with the vulnerable AMDGPU driver, regardless of vendor, as well as bare‑metal or custom kernel builds that have not incorporated the fix.

Based on the description, it is inferred that an attacker could trigger the vulnerable path by interacting with the AMDGPU driver, such as initiating GPU workloads or accessing the notifier sequence. The race condition allows the notifier sequence to be read more than once, potentially causing operations on invalid memory pages. The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. No remote exploitation vector is indicated by the available information.