In the Linux kernel’s AMDGPU driver, an improper enforcement of fence completion during a GPU reset caused the reset routine to leave a fence pending for queues not in the MAPPED state. The worker responsible for eviction and suspension would then block indefinitely on that pending fence, leading to a 120‑second or longer stall and eventually a suspended or hung machine. This results in a denial‑of‑service condition where the system becomes unresponsive. The weakness is caused by improper synchronization that allows an endless wait, and is identified as CWE‑833.

The affected environment is any Linux distribution that includes the upstream kernel with the AMDGPU driver before the patch commit 9102b39fa924dcc3dc75a3137bfa9633c40b88c0. No specific kernel version numbers are listed, so all kernels that ship the vulnerable driver, including current releases up to the date of the fix, are impacted. Users running AMD GPUs on Linux should consider this when selecting or updating kernels.

The CVSS score is 4.7. EPSS is < 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker who can trigger or accelerate a GPU reset—such as by issuing heavyweight GPU workloads, invoking driver unload/reload sequences, or manipulating memory eviction—could exploit the bug to cause the worker to block forever, forcing a system hang. Because the flaw lies in internal driver logic, exploitation requires kernel-level context, implying that privileged or local users could experience the denial of service. The CVSS score of 4.7 indicates moderate severity, but the denial of service impact remains significant.