The vulnerability arises in the Linux kernel's AMDGPU driver where capability (cap) nesting can exceed a limit of 32 levels. When a nesting level beyond this threshold is attempted, the driver returns -ELOOP, signalling an excessive recursion situation. This flaw can cause an application or user session that generates nested ATOM command tables to fail, potentially leading to a denial of service if the error is not handled gracefully. The weakness is a classic case where unbounded recursion or resource exhaustion is introduced by a system component that does not enforce a practical limit on nested operations.

The flaw is present in the Linux kernel across all Linux distributions that include the AMDGPU driver and have not applied the patch. Specific kernel versions are not enumerated in the available data, so any deployment using a vulnerable kernel revision is potentially affected.

The CVSS score of 5.5 is published, while the EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, indicating a moderate risk rating. The attack vector is likely local or requires elevated privileges to interact directly with the graphics driver; however, the fault simply manifests when the nesting depth is exceeded. Without a public exploit, the likelihood of exploitation is undetermined, but the denial of service potential remains a concern in environments that generate deep ATOM command tables.