In the Linux kernel amdgpu driver, user space can create a queue that requests a doorbell buffer object and offset that is already allocated to an existing queue. The driver uses xa_store_irq to record the mapping; a later queue creation with identical parameters can overwrite the earlier mapping. This flaw allows one queue to hijack the doorbell resources of another, leading to misrouted fence interrupts and potentially corrupting kernel state during cleanup. The weakness corresponds to improper authorization and concurrent resource misuse, as reflected by the CWE identifiers present in the advisory.

All Linux kernel releases that include the amdgpu graphics driver and lack the patch that replaces xa_store_irq with xa_insert_irq. The vulnerability is present in every kernel version prior to that commit; no specific version numbers are listed, so any older kernel is considered affected.

The CVSS score of 7.1 signals moderate to high severity. The EPSS score of < 1 % indicates a very low probability that exploitation will be observed in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local user space, and it requires a user with sufficient privileges to create an amdgpu queue. This inference is stated explicitly because the description does not specify the attack surface. Once local access is achieved, an attacker could overwrite the doorbell mapping, misroute interrupt handling, and potentially corrupt kernel state.