A flaw in the Linux kernel’s AMDGPU DRM debug address watch routine allows user-supplied watch identifiers to be treated as signed integers in internal helper functions. When a watch_id larger than the signed integer maximum is provided, the conversion to a negative value leads to an undefined bit shift, enabling a read or write outside the intended watch_points array. This can corrupt kernel memory and potentially compromise kernel integrity for the affected process.

Linux kernel builds that include the AMDGPU amdkfd debug address watch feature prior to the patch commit at https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150 are affected. The vulnerability resides in drivers/gpu/drm/amd/amdgpu/amdkfd/kfd_debug.c, and any custom or derived kernels that incorporate this component without the bounds check will also be susceptible.

The CVSS score is not documented, and the EPSS value is unavailable, so the likelihood of exploitation is uncertain. The flaw requires a user or process that can invoke the DRM debug interface to supply a malicious watch_id, indicating a local or compromised‑application attack vector. Successful exploitation would lead to kernel memory corruption and could enable privilege escalation to higher privilege levels, though such an outcome is inferred from the nature of the bug.