The defect exists in the Linux kernel's AMDGPU driver where disabling dedicated power management with the amdgpu.dpm=0 module parameter leaves the thermal work queue uninitialized, yet the driver still attempts to schedule work on it. This oversight can trigger undefined behavior that may lead to a kernel crash, causing the system to reboot or become otherwise unresponsive. The weakness is classified as CWE-908.

All Linux kernel distributions that provide the AMDGPU driver and include the DPM feature are potentially affected. The advisory does not specify exact kernel versions, so any kernel build that has not yet incorporated the commit that disables scheduling on an uninitialized queue is considered vulnerable.

The CVSS base score of 4.7 denotes a moderate impact with a low base attack complexity. The EPSS score of less than 1% signals an extremely low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly documented in the advisory; it is inferred that local or privileged access would be required to change the amdgpu.dpm module parameter or to load the driver in a way that triggers the uninitialized queue behavior.