The AMDGPU driver in the Linux kernel allowed the user‑level GEM_CREATE ioctl to accept domain flags without validating that the selected combination was allowed. A malicious requester could specify a combination of CPU|GTT|VRAM together with non‑CPU/GTT/VRAM domains such as DOORBELL, GDS, GWS, or OA. The driver then calculated a placement path count that exceeded the maximum allowed by AMDGPU_BO_MAX_PLACEMENTS, ultimately triggering BUG_ON(). This results in a kernel panic and a denial of service.

Any Linux installation that uses a kernel incorporating the vulnerable AMDGPU driver and exposes the amdgpu_gem_create ioctl (devices such as /dev/dri/render* or /dev/dri/card*) is affected. Until the kernel includes the patch that validates domain combinations and returns –EINVAL for invalid requests, all current kernel releases that have not yet integrated the fix are at risk. No detailed affected‑version information is provided by the CNA for this vulnerability.

The flaw is local; an attacker needs write access to the AMDGPU device files to craft a malicious request. This local attack vector is inferred from the fact that the kernel panic can only be triggered by a privileged user interacting with the device file, as no remote or network capability is mentioned in the description. No network or remote attack vector exists. The exploit path is straightforward – constructing an invalid domain combination – and the effect is a hard kernel crash. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the impact on system availability is high. Immediate patching is recommended to avoid local denial of service.