The vulnerability in the Linux kernel’s AMDGPU driver stemmed from a BUG_ON assertion that would trigger a kernel panic whenever a specific condition in the gfx11 code path was satisfied. The bug has been fixed by replacing the assertion with WARN_ON, which logs a harmless warning instead of halting the system. The underlying weakness corresponds to CWE-617, and the patch removes the risk of denial of service caused by the kernel crash.

All Linux kernel versions that have not incorporated the most recent amdgpu commit are vulnerable, regardless of distribution. Systems running kernels prior to the patch that still contain the original BUG_ON in the AMDGPU driver code are at risk. Kernels that have applied the patch commits are no longer affected.

The CVSS score of 4.4 indicates low severity, and the EPSS score of <1% suggests an extremely low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Because the patch replaces the faulting assertion with a warning, the system no longer experiences a kernel panic, and no exploitation mechanism is documented. If an attacker attempts to trigger the specific graphics driver condition, the mitigated code will simply log a warning.