The kernel bug occurs when amdgpu_vm_get_vm_from_pasid() returns a virtual memory context pointer that is only safe to use while a lock is held. After the lock is released the pointer can be altered, yet the driver continues to dereference vm->task_info, leading to a use‑after‑unlock condition that can corrupt kernel memory and potentially allow local code execution with elevated privileges.

This issue affects all Linux kernel builds that include the AMDGPU DRM driver before the commit that removed the problematic function. Distribution kernels that ship the unpatched driver, regardless of the vendor, are therefore vulnerable.

The CVSS score of 7.8 classifies the flaw as high severity, but the EPSS score of less than 1% suggests a low probability of exploitation. Based on the description, it is inferred that an attacker would need local or compromise-level access to trigger the race, and the problem is not yet listed in CISA KEV. Nevertheless, the potential for privilege escalation warrants prompt attention.