The Linux kernel contains a component that interfaces with AMD XDNA hardware through shared memory structures. A flexible array inside struct amdxdna_cmd_chain is guarded by a __counted_by attribute that relies on a user‑supplied command_count field. Because the shared structure is writable from user space, an attacker can change command_count to zero while the kernel also reads the array. The attribute then generates a bounds check that fails, causing the kernel to panic. This results in a denial of service – the entire system crashes.

Any Linux kernel installation that builds the accel/amdxdna driver and contains the vulnerable struct prior to the patch in commit 52f3e086. The problem exists in all kernel versions that have not applied the repository change. The fix was made in the upstream Linux kernel source; systems should refer to the latest stable release to verify the existence of the commit.

The vulnerability is classified as a kernel panic, a direct denial of service that typically requires local interaction with the affected driver or firmware interface. No publicly available exploits are known, EPSS data is not available, and the vulnerability is not listed in CISA KEV yet. Because the flaw depends on a user‑controlled buffer length, exploitation is likely limited to environments where the attacker can influence the shared memory area or driver state.