Based on the description, the AMDGPU driver fails to remove its genpd structure from the global list before freeing it, leaving a dangling pointer that may be dereferenced. This oversight can cause kernel memory corruption, potentially leading to a crash or, if an attacker can manipulate the memory layout, execution of arbitrary code at privileged rings. The vulnerability arises from a type of use‑after‑free condition linked to improper resource cleanup, corresponding to CWE-825. The affected systems are Linux kernel images that contain the unpatched AMDGPU driver. This includes all mainstream distribution kernels prior to the commit that implements pm_genpd_remove() before freeing the genpd structure. Kernel builds that have not incorporated the patches referenced in the advisory are at risk. Users should check the kernel version against the commit identifiers cited in the references to determine if the issue is present.

Linux kernel implementations, including mainstream distribution kernels, that have not incorporated the patch at commit cd8650d7a91ee8b768e202354672553faa5cc1f2 and subsequent changes. All builds prior to that commit are affected; no specific downstream version list is available.

Risk assessment shows that the EPSS score is < 1% and the vulnerability is not listed in CISA KEV, making exploitation probability unclear. The CVSS score of 7.8 indicates a high severity vulnerability. A kernel memory corruption flaw can lead to denial of service or privilege escalation. The likely attack vector is local: a user with ability to trigger AMDGPU device unloads or resets can provoke the defect; modern kernels protect module unloading from unprivileged users, so remote exploitation would require additional compromise steps. Once triggered, a crafted payload could lead to kernel code execution.