The vulnerability is a NULL pointer dereference that occurs in the AMD XDNA accelerator mailbox cleanup functions when a channel has already been destroyed. If the cleanup path is invoked after a channel has been freed, the kernel dereferences a null mailbox channel pointer, which can bring the entire system down via a kernel panic. This gives an attacker the ability to disrupt service but does not provide a direct code‑execution path.

All Linux kernel releases that include the amdxdna driver before the commit adding NULL checks (referenced in the advisory links). Any configuration that loads the amdxdna driver and performs mailbox channel cleanup operations is susceptible while the kernel has not been patched to include the fix. No specific version range is disclosed.

The CVSS score is not provided in the data, and the EPSS score is unavailable, so the precise probability of exploitation is unknown. The issue is not listed in CISA KEV, indicating no known publicly available exploits. It is inferred that the flaw could be triggered by an attacker who can control or influence the error‑handling paths of the amdxdna mailbox interface, such as via malformed commands sent to the hardware device. The likely attack vector is therefore a specialized hardware or local attacker scenario rather than a generic remote exploit.