The vulnerability arises in the Linux kernel’s AMD XDNA acceleration driver. A flexible array in struct amdxdna_cmd_chain is guarded by a __counted_by(attribute) that relies on a user‑controllable command_count field. Because the structure resides in a shared memory area (AMDXDNA_BO_SHARE) writable by user space, an attacker can set command_count to zero while the kernel later accesses the array. The generated bounds check then fails, causing the kernel to panic and the system to crash, which is a denial‑of‑service failure mode.

Any Linux kernel that builds the accel/amdxdna driver and contains the vulnerable struct before the repository change. This includes all kernel versions that have not incorporated commit 52f3e086, regardless of distribution or patchlevel. Systems that expose the AMD XDNA firmware interface via shared memory are susceptible.

The CVSS score of 5.5 classifies the flaw with medium severity. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a low publicly known exploitation likelihood. Based on the description, it is inferred that the attacker must be able to write to the shared memory used by the AMD XDNA driver, which typically requires local or administrative privileges. Thus the likely attack vector is local interaction with the driver or firmware interface, and the vulnerability does not appear to be exploitable from a remote context. The potential impact remains a kernel panic and a complete denial of service for the affected system.