In the Linux kernel’s AMDGPU driver, userspace can provide an arbitrarily large number of buffer object (BO) list entries through the bo_number field. The previous overflow check stops out‑of‑bounds allocation but does not limit how many entries can be requested. A large request can therefore cause the driver to allocate a massive amount of memory—potentially many gigabytes—and to perform very long list traversals, leading to severe memory exhaustion and slowed system performance. The fix introduces a hard limit of 128 000 entries per BO list, and returns an error if the requested count exceeds this limit, preventing the excessive allocation from occurring.

This issue affects the AMDGPU component of the Linux kernel. The vulnerability is present in all kernel versions that compile the affected driver before the commit that enforces the 128 000 entry limit. No specific version ranges are listed, so any kernel build without the patch is potentially vulnerable.

The attack requires a process that can communicate with the AMDGPU driver, typically a privileged or user‑space application with DRM access. Because the vulnerability relies on kernel‑mode allocation, exploitation is likely limited to local or privileged users, reducing the likelihood of widespread remote attacks. The lack of an EPSS score and absence from the CISA KEV catalog suggest moderate exploitation risk, but the potential for DoS by exhausting system memory remains a serious concern for affected systems.