In the Linux kernel, the amdgpu driver contains a null‑pointer dereference in the nbio_v7_9 interrupt handler. The function nbio_v7_9_handle_ras_controller_intr_no_bifring() accesses the ras and obj structures without checking for NULL, leading to a kernel panic when an interrupt is received during a sparse initialization window. This results in an immediate system crash, constituting a denial‑of‑service vulnerability that does not provide remote code execution or data exfiltration.

Any Linux system running a kernel that includes the affected amdgpu driver before the upstream fix is vulnerable. The vulnerability applies to all distributions that ship the kernel with the old amdgpu driver code unless they have already applied the patch commit. Specific kernel version details are not listed in the advisory, so administrators should verify their kernel releases against the commit hash introduced in the fix commit.

Because the flaw triggers in hard‑IRQ context and requires a ras interrupt, the attack vector is local and depends on hardware events that may be difficult to control remotely. The EPSS score is less than 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. While no publicly documented exploitation steps exist, the crash can disrupt production environments, indicating a moderate risk for affected systems. The CVSS score is 5.5, which is a medium severity rating.