The vulnerability is a null pointer dereference in the drm/amd/display subsystem that occurs when dc_update_planes_and_stream is called separately for a stream and its phantom. The dereference can trigger a kernel panic, causing the system to reboot or become unresponsive, representing a denial of service. This weakness is classified as a null pointer dereference (CWE-476).

The flaw lies in the Linux kernel’s AMD display driver (drm/amd/display). Any Linux kernel build that contains the vulnerable code, including commonly used distributions that ship with the default AMD display module, is at risk. No specific version range is enumerated, but all kernels prior to the patch commit should be treated as affected.

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and no EPSS score is available, yet the severity implied by a kernel crash suggests a high risk. An attacker with local access that can trigger display updates, such as a user session that launches a graphical application, could exploit the fault to crash the kernel. The risk warrants prompt patching.