Technical impact
The vulnerability is an improper input validation flaw in the AMD RAID driver. The driver can be coerced to reference an arbitrary memory location, allowing an attacker to execute privileged instructions and run arbitrary code. This flaw could lead to a full privilege escalation on the affected system, resulting in the compromise of confidentiality, integrity, and availability.
Affected Systems
The flaw affects a broad array of AMD processors including Athlon 3000 Series Mobile with Radeon Graphics, EPYC 4004, 4005 and Embedded 4005 Series, Ryzen 2000, 3000, 4000, 5000, 6000, 7000, 7020, 7040, 7045, 8000, 8040, 9000, 9000HX, AI 300, AI Max 300, Threadripper 7000 WX, 9000, PRO 3000 WX, PRO 5000 WX, and Z2 Series. Specific product versions that implement the driver are not disclosed in the advisory.
Risk and Exploitability
The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector is local or requires privileged execution because the flaw exists in a kernel‑mode driver. An attacker who can load or interact with the RAID driver may manipulate its input vectors to trigger a privilege escalation, leading to arbitrary code execution. Consequently, the exploitation risk is high for systems that expose the RAID driver to potentially compromised processes or users.
