The Linux kernel’s amdgpu driver has a flaw where an unbounded doorbell_offset supplied by user space is passed to a function without bounds checking. If an attacker provides a doorbell_offset larger than the allocated doorbell buffer object, the calculated index can reference memory outside that buffer. This out‑of‑bounds write corrupts kernel memory, potentially causing a crash or compromising kernel integrity if the overwritten data is leveraged.

All Linux kernel releases that include the amdgpu driver before the commit adding bound checking for doorbell_offset are affected. The CVE does not list specific version ranges, so any kernel containing the unvalidated handling routine remains vulnerable until the fix is applied.

The flaw can be triggered by user‑space code that creates an amdgpu user queue with a malicious doorbell_offset. Because the kernel performs the unchecked calculation, the attack works from a local user context with access to the amdgpu driver. EPSS data is not available and the issue is not in CISA KEV, leaving the exact exploitation likelihood uncertain. The primary risk is kernel memory corruption that could destabilize the system; additional privilege escalation is possible only if the attacker can influence the overwritten data.