During the loading of the AMDGPU driver, a null pointer to a MES structure was dereferenced when MES initialization failed, triggering a kernel panic. The resulting crash brings the entire system offline, delivering a denial-of-service. This flaw is a classic NULL pointer dereference, classified as CWE‑476.

All Linux kernel releases that include the legacy AMDGPU driver before the application of commit 5bc93f9 are vulnerable. Systems using AMD GPUs with MES support in those kernels can experience a crash, regardless of distribution. The precise version range is not listed, but any kernel lacking this specific patch is at risk.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The CVSS score is 4.1, indicating moderate severity, while a kernel panic still represents a full denial‑of‑service. Exploitation requires the ability to force the driver to load and fail, which is likely a local attack, such as installing a malicious driver module or manipulating hardware initialization. Overall, the risk is significant for environments that run vulnerable kernels and allow local code execution or GPU driver modification.