Zero‑length command chains in the Linux AMDX DNA accelerator bypass the normal payload length check. The driver then submits a request with a buffer of length zero, causing the memory copy loop to skip entirely. When the firmware processes the empty command chain, it reads a byte immediately before the buffer and faults on the virtual memory guard page. An attacker who can open a render node can trigger this fault, leading to a kernel panic and a system crash.

All Linux kernels that include the accel/amdxdna driver are potentially affected, regardless of vendor distribution. No specific version information is supplied; administrators should verify whether their deployed kernel contains the recent fix that rejects empty command chains, which has been incorporated in newer upstream releases.

The CVSS score is not provided, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The flaw can be exercised locally by any process with access to a render node, without requiring elevated privileges. Exploitation results in a kernel fault and system crash. There is no indication from the advisory that the fault provides privilege escalation or arbitrary code execution.