This vulnerability resides in the Linux kernel's DRM AMDKFD driver. The kfd_event_page_set() function performs a memset operation of KFD_SIGNAL_EVENT_LIMIT * 8 bytes onto a buffer that is not verified against the supplied size argument. If an attacker supplies a buffer smaller than the requested length, the memset writes beyond the buffer boundaries, corrupting adjacent kernel memory. This bug can be abused by an unprivileged user to alter kernel data structures and elevate privileges to root.

All Linux kernel releases that contain the DRM AMDKFD module are affected prior to the patch. The module is part of the Direct Rendering Manager for AMD GPUs. Customers running custom or distribution kernels with the outdated AMDKFD code must verify whether their kernel version incorporates the fix. The vulnerability compromises the entire kernel memory space rather than only a single device.

The attack requires local access to the kernel via the DRM interface and knowledge of the buffer size expected by kfd_event_page_set(). No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. The CVSS score is not indicated, but the impact is a classic privilege escalation that may grant unrestricted system control. While no publicly known exploit exists, out‑of‑bounds writes in kernel code frequently lead to efficient kernel exploits. Administrators should treat this as high risk and apply the available patch promptly.