The Linux kernel contains a bug in the AMDGPU display driver where amdgpu_dm_crtc_set_vblank() dereferences a NULL stream pointer when vblank is enabled or queried through DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream has been attached. A NULL pointer dereference at this point triggers a kernel panic, resulting in a system crash and immediate denial of service. This vulnerability arises from a missing null check before accessing acrtc_state->stream and aligns with CWE‑476.

This issue affects all Linux kernels that incorporate the amdgpu display driver before the commit 7b1b31b. Any system running an unpatched kernel version with an AMDGPU device is susceptible. The attack is limited to systems where a user or process can access the GPU device nodes, typically exposed as /dev/dri/card*.

The EPSS score is not available and there is no CVSS score listed, and the vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local privilege via the DRM_IOCTL_MODE_CRTC_GET_SEQUENCE ioctl, which requires access to a GPU device node. If an attacker can send this ioctl, they can provoke a kernel crash, causing a denial of service. No active exploitation has been reported, but the lack of a null guard means a kernel panic is guaranteed when the condition is met.