The Linux kernel’s amdgpu driver allocates a 64‑byte instruction buffer for the cleaner shader via a sysfs interface but mistakenly fills 256 dwords, causing a buffer overflow and a kernel page fault. The result is a system crash that denies availability of all users. This flaw represents a classic kernel buffer overflow where the attacker can trigger a crash by writing to the exposed sysfs entry. The vulnerability is limited to local system users who can write to that sysfs path, and no remote or privilege‑escalating exploitation is documented.

Any Linux kernel running the amdgpu driver before the patch was applied is vulnerable. The bug was fixed in commits referenced in the advisory, so kernel releases containing those patches are considered patched. Specific version numbers are not listed, so users should verify that their kernels include the commit that bounds the patch.

The CVSS score is 4.7 and the EPSS score is below 1%, indicating that no widespread exploitation data exists today. However, a local user with write access to the cleaner shader sysfs entry can reliably trigger a kernel fault, making this a medium‑to‑high risk denial of service within the affected environment. The vulnerability is listed outside CISA KEV, which suggests no known active exploits are currently cataloged. The attack vector is inferred to be local via sysfs writes; there is no evidence of remote exploitation or privilege escalation.