A race condition in the Linux kernel’s drm/amdkfd driver allows a concurrent destroy operation to free the queue while another thread still references it, resulting in a use‑after‑free during destroy_queue_cpsch. The function wait_on_destroy_queue releases locks to wait for queue resume, and a flag named is_being_destroyed is used to serialize the destruction process. The flaw falls under CWE‑825 and could lead to kernel‑level memory corruption, potentially enabling privilege escalation or arbitrary code execution if successfully exploited. The vulnerability is identified as a high‑severity flaw that can compromise system integrity if an attacker has sufficient access to manipulate timing between destroy operations.

Linux kernel builds that include the drm/amdkfd DRM driver before the patch are affected. Since the description does not specify exact version ranges, any kernel with the vulnerable destroy_queue_cpsch code is considered at risk.

The CVSS score of 7.8 marks the vulnerability as high severity, while the EPSS score of <1% indicates a very low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged access to orchestrate the necessary timing for the use‑after‑free, but this attack vector is inferred from the description, not explicitly stated.