The vulnerability is a NULL pointer dereference in the AMD XDNA accelerator mailbox cleanup functions of the Linux kernel. When the cleanup path is invoked after a mailbox channel has already been freed, the kernel attempts to dereference the null pointer, which triggers a kernel panic and effectively brings the system down. No code‑execution path is provided by the flaw; it only allows a service interruption.

All Linux kernel releases that contain the unpatched AMD XDNA driver. Any kernel version prior to the commit that adds NULL checks to xdna_mailbox_free_channel() and xdna_mailbox_stop_channel() is vulnerable. This includes all distributions and custom builds that ship the default Linux kernel with the amdxdna driver enabled.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% shows that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The flaw would most likely be triggered by a local or privileged user who can interact with the AMD XDNA driver and force the problematic error‑handling path, leading to a system crash.