The flaw lies in the AMDKFD DRM subsystem of the Linux kernel: during a CRIU restore the function kfd_queue_acquire_buffers() is omitted from set_queue_properties_from_criu(), leaving queue buffer fields unset. Subsequent kernel code expects these buffers to be populated, so a missing or null reference can cause a kernel fault. This results in a crash or reboot, effectively denying service on the affected system.

All Linux kernel configurations that include the AMDKFD DRM subsystem are affected. The patch has been added to the kernel source, but a version list is not provided in the advisory, so any kernel built before the applied commit should be considered vulnerable.

The CVE is not listed in the CISA KEV catalog and no EPSS score is available, suggesting that public exploitation is currently low. The vulnerability requires a local or privileged attacker to trigger a CRIU restore that uses the AMDKFD module; the impact is solely a kernel crash, so the primary risk is denial of service to the affected host. While the exploitability is limited to local contexts, the lack of a patch makes it a priority for any systems running the affected kernel versions.