The AMDGPU amdkfd debug subsystem mishandles the watch_id argument in the address watch clear interface, treating an unsigned 32‑bit identifier as a signed integer and performing unchecked bit shifts; if a very large watch_id is from userspace, the value becomes negative causing undefined shifts and allowing out‑of‑bounds writes into the watch_points array, resulting in a kernel buffer overflow that can corrupt kernel memory.

The flaw resides in the Linux kernel's amdkfd component, specifically drivers/gpu/drm/amd/amdgpu/.../amdkfd/kfd_debug.c, and affects any system running a kernel build that includes this component with the debug watch feature enabled; this includes mainstream distributions shipping recent AMDGPU drivers with debugging turned on for AMD GPU devices.

The CVSS score of 7.8 denotes high severity, while the EPSS score of less than 1% indicates low current exploitation likelihood; the vulnerability is not listed in the CISA KEV catalog. The attack seems to be local: an attacker would need to invoke the debug address watch clear API exposed by the amdkfd driver. Based on the description, it is inferred that the attacker must have access to the DRM debug interface, which is typically limited to privileged users or processes with the drm_debug capability. If such access is obtained, supplying a watch_id larger than INT_MAX would trigger a buffer overflow, potentially leading to kernel crash or privilege escalation.