The amdkfd debug subsystem in the Linux kernel incorrectly handles an unsigned watch_id argument when clearing address watches. The value is later treated as a signed integer, resulting in negative shift operations and a potential buffer overflow in the watch_points array. This undefined behavior can trigger kernel memory corruption, a crash, or privilege escalation for a malicious actor who can supply a very large watch_id from userspace.

The flaw resides in the Linux kernel, specifically within the AMDGPU amdkfd driver (drivers/gpu/drm/amd/amdgpu/.../amdkfd/kfd_debug.c). Any system running a kernel build that includes the amdkfd component with the debug watch feature enabled is affected. This includes typical mainline kernels shipped with AMDGPU drivers that support debug watches.

The CVSS score of 7.8 denotes high severity, while an EPSS score of less than 1% indicates a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local via the AMDKFD debug interface; the attacker must be able to invoke the debug address watch clear API exposed by the driver, typically requiring privileged access or the drm_debug capability. If such access is obtained, providing a watch_id larger than INT_MAX can trigger the overflow and result in kernel corruption or privilege escalation.