In the Linux kernel’s AMDGPU driver, userspace can provide an arbitrarily large number of buffer object (BO) list entries through the bo_number field. The earlier overflow check prevented out‑of‑bounds allocation, but it did not constrain the total number of entries requested. A very large request can therefore cause the driver to allocate an excessive amount of memory—potentially many gigabytes—and to traverse a long list, which can exhaust system resources and degrade performance. The fix introduces a hard limit of 128,000 entries per BO list and returns an error when the requested count exceeds this threshold, preventing the excessive allocation.

This issue is present in the AMDGPU component of the Linux kernel before the commit that enforces the 128,000 entry limit. All kernel builds that compiled the affected driver without applying the patch are potentially vulnerable. The known affected kernel versions are those represented by the CPE strings – Linux kernel 7.0 RC1 through RC4 and all other releases compiled with the unpatched driver.

The vulnerability requires a process that can interact with the AMDGPU driver, typically a user‑space application with DRM access or a privileged user. Because exploitation involves kernel‑mode memory allocation, it is likely limited to local or privileged users, reducing the chance of remote attacks. The CVSS score of 5.5, an EPSS score of < 1 %, and absence from the CISA KEV catalog all indicate a moderate exploitation risk, but the potential for a denial‑of‑service attack by exhausting system memory remains significant.