In the Linux amdgpu driver, a user‑space program can request a doorbell buffer object and offset that are already assigned to an existing queue. Because the driver uses xa_store_irq to record the mapping, a subsequent creation of a queue with the same BO and offset can overwrite the previous mapping. This enables a malicious user to route fence interrupts to an incorrect queue and cause cleanup of one queue to erase another’s mapping, potentially corrupting kernel interrupt handling and kernel state. The weakness is an instance of improper authorization and improper use of allowlist mechanisms.

Linux kernel (amdgpu driver). No specific version information is available; the vulnerability exists in any kernel version prior to the commit that replaces xa_store_irq with xa_insert_irq.

The CVSS score is 7.1, the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker requires local access with kernel or privileged user rights to create a user‑queue and supply the BO and offset. If this is achieved, the attacker can overwrite an existing doorbell mapping, potentially misrouting fence interrupts and corrupting kernel state. The exploitation does not involve network or remote code execution; it requires only local privileged execution.