In the AMDGPU driver for Linux, the internal display controller structure (struct dc) has grown large enough that allocating it with kzalloc requires a contiguous block that exceeds the page allocator’s 4 MiB limit. The allocator rounds the request to an 8 MiB contiguous region, which exceeds MAX_PAGE_ORDER and returns NULL. Because the driver does not correctly handle this failure, GPU initialization aborts, rendering the display subsystem unusable. This flaw typifies an out‑of resources condition (CWE-770) and, while it does not enable code execution or information disclosure, it can be triggered by normal driver activity and results in a local denial of service.

Any Linux kernel that includes the default AMDGPU driver and compiles with a configuration where struct dc can grow beyond 4 MiB is affected. Since the patch that switches to kvzalloc is present only in recent upstream releases, typically all mainstream kernel builds shipped in the past few years may be susceptible if their build configuration allows the structure to exceed the threshold.

The vulnerability has a CVSS score of 5.5, indicating medium severity, and an EPSS score of less than 1 %, pointing to a very low likelihood of exploitation. It is not listed in CISA’s KEV catalog, and it requires local access to the system and the GPU to trigger. When activated, it causes a denial of service for display output, without providing privilege escalation or data compromise. The overall risk is therefore considered low to moderate, primarily affecting the user experience rather than system security.