The amdgpu_debugfs_gpr_read() function in the Linux kernel’s AMDGPU driver erroneously drops its runtime power management reference twice. The first drop occurs normally after reading wave registers, and a second drop is performed when an error path is triggered during a failed copy_to_user() operation. This double decrement allows the runtime PM usage counter to underflow from one to zero, which can cause the driver to believe the device is unused and potentially power it down. The counter underflow can manifest as kernel log entries such as ‘Runtime PM usage count underflow!’ and may lead to unstable device behavior or system hang when the device is unexpectedly powered off.

The vulnerability affects the Linux kernel’s AMDGPU driver on any version that contains the buggy amdgpu_debugfs_gpr_read() implementation. It is present in kernels that lack commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a, which resolves the double‑drop issue. Systems running these kernel versions on AMD Navi31 GPUs are particularly susceptible.

There is no EPSS score available and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is not provided in the input. Because the bug is triggered by a local read operation into the amdgpu debugfs GPR interface, the exploitation window requires privileged local access (root or equivalent). An attacker who can invoke amdgpu_debugfs_gpr_read() with a bad buffer can cause the PM counter underflow, leading to potential service disruption. While the EPSS score is unknown, the control needed to exploit the flaw points to a moderate to high risk for systems with exposed or untrusted users able to write to the kernel debugfs interface.