The AMDGPU driver in the Linux kernel permits the user‑level GEM_CREATE ioctl to accept domain flags without validating that the selected combination is allowed. A malicious requester could specify a combination of CPU|GTT|VRAM together with non‑CPU/GTT/VRAM domains such as DOORBELL, GDS, GWS, or OA. The driver then calculates a placement path count that exceeds the maximum allowed by AMDGPU_BO_MAX_PLACEMENTS, triggering BUG_ON() and a kernel panic. This results in a denial of service that disrupts system availability.

Any Linux installation that incorporates the vulnerable AMDGPU driver and exposes the amdgpu_gem_create ioctl via device files such as /dev/dri/render* or /dev/dri/card* is affected. The known vulnerable configuration is any kernel that has not yet merged the patch that validates domain combinations. The likely attack vector is local, requiring the attacker to have write access to the AMDGPU device files. No detailed affected‑version information is provided by the CNA.

The vulnerability carries a CVSS score of 7.8, indicating high severity. Based on the description, the likely attack vector is local; an attacker must first obtain write access to the device files. There is no mention of remote capabilities, so remote exploitation is not inferred. Exploitation requires simple construction of an invalid domain combination, causing a kernel crash. The EPSS score is < 1%, implying a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Immediate patching is recommended to avoid local denial of service, but the risk of exploitation remains low due to the local access requirement.