An off‑by‑one error in dma_fence_dedup_array causes the function to return 1 when the fence count is zero, contrary to its documented expectation of returning 0 for empty input. The invalid return value can lead to dereferencing an uninitialized fence slot in the AMDGPU user queue wait path, potentially corrupting kernel memory and triggering a kernel crash or denial of service.

All Linux kernel builds that include the pre‑patch implementation of dma_fence_dedup_array, which is present in every kernel version before the commit that inserts the early 0‑return guard. Any distribution that uses an AMDGPU driver capable of invoking the user queue wait path is vulnerable; the advisory does not list specific vendor or version ranges.

The CVSS score of 7.8 indicates high severity, while the EPSS value of <1% suggests a very low likelihood of exploitation. Based on the description, the likely attack vector is local kernel manipulation: an attacker would need to execute privileged code or leverage another privilege‑escalation flaw to trigger the AMDGPU code path that calls the faulty routine. The vulnerability is not listed in CISA KEV, so no public exploit is confirmed. Mitigation focuses on applying the patch rather than on detection.