In the Linux kernel’s AMD display driver, the function dml21_add_phantom_plane() can fail to allocate a phantom plane but the code later dereferences the resulting null pointer. The failure was not checked, leading to a kernel segmentation fault that boots the system down. This is a classic null pointer dereference in kernel space and results in a denial of service to all users on the affected machine.

Any Linux kernel that includes the AMD display driver code and has not incorporated commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f is affected. The vendor/product is Linux, and all kernel versions containing the vulnerable code path—i.e., those that ship the AMD display driver without the null‑check—could be at risk. No specific version range is listed, so the risk applies to all kernels before the patch is applied.

The CVSS score of 5.5 classifies the flaw as medium severity, and the EPSS score is less than 1%, indicating a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Exploitation requires access that allows the attacker to trigger the AMD display subsystem or otherwise exercise the failing code path, which suggests the attack vector is most likely local, though a remote vector could exist if an attacker has the ability to induce GPU activity or obtain local privileges.