The kernel driver for AMD GPUs contains a null‑pointer dereference that occurs when a user submits an excessively small CP_GFX_SHADOW chunk (length_dw == 0). The kernel’s command‑submit path walks a zero‑length buffer, interprets it as a structured shadow data block, and reads a field from the resulting pointer. This invalid access faults the kernel, causing a system reboot. The same flaw existed in other lightweight chunk types, but the CP_GFX_SHADOW case had no length guard until this patch. The vulnerability is a classic Flutter “Null Pointer Dereference” that leads to a denial‑of‑service condition.

All Linux kernel releases that compile with the amdgpu driver and have not yet applied the patch that adds a minimum‑length check for the CP_GFX_SHADOW chunk. The affected code lives in drm/amdgpu and applies to devices that enable the render group for users to submit command buffers. No other products or platforms are listed.

The flaw is exploitable by any unprivileged user in the render group that can submit command buffers. No network exposure or elevated privileges are required; the attack is local and only needs interface access to the DRM device. The EPSS score is not supplied, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly observed exploitation yet. However, the impact is severe—an unpatched system can be brought down at will by a user who can write to the GPU device. The risk is mitigated only by applying the kernel patch that enforces the chunk length check before the data is interpreted.