The flaw lies in the AMDKFD DRM subsystem of the Linux kernel: during a CRIU restore the function kfd_queue_acquire_buffers() is omitted from set_queue_properties_from_criu(), leaving queue buffer fields unset. Subsequent kernel code expects these buffers to be populated, so a missing or null reference can cause a kernel fault. This results in a crash or reboot, effectively denying service on the affected system.

All Linux kernel configurations that include the AMDKFD DRM subsystem are affected. The patch has been added to the kernel source, but a version list is not provided in the advisory, so any kernel built before the applied commit should be considered vulnerable.

The CVE is not listed in the CISA KEV catalog and the EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation. The CVSS score of 5.5 categorizes it as a medium severity vulnerability. Based on the description, it is inferred that a local or privileged attacker could trigger a CRIU restore that uses the AMDKFD module, leading to a kernel crash. Thus, the primary risk is denial of service to the affected host. While the exploitability is limited to local contexts, the lack of a patch makes it a priority for any systems running the affected kernel versions.