Zero‑length command chains in the Linux AMDX DNA accelerator bypass the normal payload length check. The driver then submits a request with a buffer of length zero, causing the memory copy loop to skip entirely. When the firmware processes the empty command chain, it reads a byte immediately before the buffer and faults on the virtual memory guard page. An attacker who can open a render node can trigger this fault, leading to a kernel panic and a system crash.

All Linux kernels that include the accel/amdxdna driver are potentially affected, regardless of vendor distribution. No specific version information is supplied; administrators should verify whether their deployed kernel contains the recent fix that rejects empty command chains, which has been incorporated in newer upstream releases.

The CVSS score is 5.5, EPSS < 1%. The vulnerability is not listed in CISA KEV. The flaw can be exercised locally by any process with access to a render node, without requiring elevated privileges. Exploitation results in kernel fault and system crash. No indication from the advisory that the fault provides privilege escalation or arbitrary code execution.