The vulnerability resides in the AMDGPU component of the Linux kernel. The driver fails to acquire the pm.stable_pstate_ctx_lock when initializing or destroying GPU contexts. This race condition can trigger a use‑after‑free or a NULL pointer dereference when the driver accesses the pstate context structure, potentially corrupting kernel memory and causing a crash. The bug also allows a context cleanup to restore an incorrect pstate value, further destabilising the system.

Any system running an unpatched Linux kernel that loads the AMDGPU driver. This includes desktop, laptop, and server machines using the default kernel build and an AMD GPU, as long as the amdgpu module is active and GPU contexts can be created.

The CVSS base score of 7.8 indicates high severity. The EPSS score of < 1% suggests a low probability of current exploitation. The vulnerability is not in CISA’s KEV catalog. Although the description describes a race condition requiring concurrent access to the driver, it is inferred that the attack can be performed locally by creating or destroying GPU contexts, which typically requires user‑level privileges on the affected system. Successful exploitation would result in a kernel crash, leading to a denial of service, without evidence of privilege escalation or data leakage.