The vulnerability arises when the AMDGPU KFD driver assumes a fully populated node array during initialization. If initialization fails before allocating nodes, the kernel later dereferences a null or uninitialized node during a GPU reset, causing a kernel crash. The result is a denial of service on a system with privileged kernel access. Based on the description, it does not provide remote code execution capabilities.

Affected systems are Linux kernel installations that include the AMDGPU driver where the KFD runtime may be enabled. The vulnerability is present in kernel code that has not yet applied the commit that checks the KFD initialization flag before accessing the node array. No specific kernel version ranges are provided in the CVE data.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on publicly available information, no exploit has been reported; however, this conclusion is inferred from the absence of documented exploits. A local or privileged attacker could still trigger a kernel crash by causing a GPU reset after a failed KFD initialization. The risk level is moderate, as it requires kernel-level access or a device that can provoke a reset on a compromised or misconfigured system. The CVSS score is 5.5, reflecting a medium severity vulnerability.