A flaw in the Linux kernel’s AMD GPU driver causes allocated memory to be freed with the wrong routine. The driver uses kvcalloc() to obtain buffer space, a function that can return memory from vmalloc for large allocations. When the improper kfree() routine is used to release that buffer, vmalloc memory is corrupted, which can result in system instability or the execution of arbitrary code in kernel mode. This type of vulnerability is commonly classified as a memory corruption issue, related to the wrong deallocation of kernel space memory.

The vulnerability affects Linux kernel versions that include the amdgpu driver. All distributions that ship a kernel with the AMDGPU module compiled in are potentially impacted, regardless of vendor, because the flaw lies in the generic amdgpu code. No specific patch releases are named in the data, so any kernel build that incorporates the vendor’s amdgpu fix is considered mitigated.

The CVSS score for this vulnerability is 7.8, indicating a high severity, while the EPSS score is less than 1% and it is not listed in CISA KEV. With a memory corruption defect that can corrupt vmalloc memory allocated by kvcalloc, the impact remains high, potentially allowing exploitation that leads to privilege escalation or denial of service. The likely attack vector requires an attacker with the ability to cause the amdgpu module to allocate and then free memory, typically through user‑space processes that interact with the GPU, root privileges, or the ability to load a malicious kernel module. No publicly available exploits are listed in KEV, but the kernel‑level memory corruption presents a significant threat if the flaw were to be leveraged.