The vulnerability allows users with access to the /dev/kfd device to terminate another process's GPU debug session without verifying session ownership or requiring ptrace authorization. This missing authorization step (CWE‑1220) enables local users to disrupt active debugging operations, causing denial of service to debugging activities.

The flaw exists in the Linux kernel DRM KFD subsystem and affects all kernel versions that lack the corresponding patch. The affected product is the Linux kernel, with no specific downstream version information provided in the data.

The vulnerability is a local issue exploitable by any user with write access to the /dev/kfd device. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the issue is not listed in CISA KEV. Exploitation requires merely that the attacker has write access to the /dev/kfd character device, which is typically granted to privileged users; thus the risk is significant for environments that permit unrestricted access to this device. The CVSS score of 5.5 indicates medium severity. The missing authorization check (CWE‑1220) enables this local privilege escalation.