The Linux kernel contains a flaw in the AMD XDNA acceleration module where the command header field that counts payload items is not bounded against the remaining buffer size. This omission can cause an out-of-bounds write that corrupts adjacent kernel memory. An attacker who can supply malicious commands to the driver could overwrite critical data structures, potentially leading to privilege escalation or system instability. The type of weakness is a classic buffer overflow (CWE-787). The likely attack vector is an attacker with the ability to send crafted commands to the AMD XDNA driver; this is inferred from the description of the vulnerable code path.

All Linux kernel builds that compile the AMD XDNA acceleration module are affected. The CPE list indicates all Linux kernels, including kernel 6.14 and the 7.0 release candidates rc1 through rc7. Any kernel that contains the vulnerable code before the fix remains at risk.

The CVSS base score of 7.1 indicates high severity. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of large-scale exploitation. Nevertheless, because an attacker could write arbitrary kernel memory if they control command payloads, the potential impact is severe. The vulnerability can be leveraged for privilege escalation if an attacker can interact with the driver; no public exploit is available, but the risk remains theoretical.