The Linux kernel’s AMDGPU driver contains a flaw in the handling of context power‑state (pstate) overrides. The code fails to acquire the lock protecting the stable pstate pointer during both initialization and cleanup, causing use‑after‑free or NULL pointer dereference conditions when a GPU context is created or destroyed. These bugs can corrupt kernel memory and result in a crash, leading to a denial of service for the host. The weakness is a classic pointer error (CWE‑476). No elevation of privilege or remote exploitation path is evident, and the impact remains limited to local kernel instability.

Any machine running a Linux kernel that ships with a kernel version prior to the commit that introduced the fix and that uses the AMDGPU driver. This includes desktops, laptops, gaming rigs, servers, or any other system that loads the amdgpu module and creates GPU contexts, either for graphical rendering or GPU‑accelerated workloads.

With a CVSS score of 7.8, the vulnerability is classified as high severity. The EPSS score of < 1% indicates a low current likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires local access to create or destroy GPU contexts, typically needing user privileges on a kernel that has not received the patch. The expected outcome is a kernel crash and system instability, not privilege escalation or data leakage.