A flaw in the Linux kernel’s Advanced Micro Devices graphics driver prevents a thermal work queue from being initialized when the dedicated power management (DPM) feature is disabled via the amdgpu.dpm=0 module parameter. The kernel code mistakenly attempts to schedule work on this uninitialized queue, which can lead to a kernel crash. The result is a loss of availability for the system or any services that depend on the kernel, potentially allowing a local attacker to cause denial of service by manipulating the power management settings or rebooting the driver.

All Linux kernel distributions that include the AMDGPU driver with DPM functionality, regardless of vendor, may be impacted if the kernel has not been updated to include the commit that disables scheduling when the queue is uninitialized. No specific version ranges are disclosed, so any kernel prior to the patch should be considered vulnerable.

The CVSS base score and EPSS score are not publicly available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no active exploitation has been reported. The attack requires local or privileged access to modify kernel module parameters or trigger driver loading, making the risk moderate to low in purely remote scenarios. However, an internal attacker could exploit the flaw to cause a kernel panic, potentially leading to persistence or denial of service if the system fails to recover. The primary attack vector is therefore local with kernel-level privileges.