The vulnerability is an out‑of‑bounds read triggered during the parsing of an IB (in‑band) buffer within the amdgpu vcn4 driver in the Linux kernel. The read occurs because the original parsing function does not enforce bounds and the patch replaces it with the amdgpu_ib_get_value() helper that correctly validates the size. An attacker that can supply a malicious IB could cause the kernel to read memory beyond the intended buffer, potentially exposing sensitive data or causing a crash.

The flaw exists in any Linux kernel that contains the amdgpu driver code before the commit that applies the patch. In practice that includes most recent mainline kernels up to the commit where the change was made. Vendor‑specific distributions may still ship kernels with the vulnerable code until they apply the patch.

The CVSS score for this vulnerability is 7.1. The EPSS score is <1%, and it is not listed in the CISA KEV catalog, so while a risk score cannot be quantified, the low EPSS suggests limited current exploitation activity. Nonetheless, out‑of‑bounds reads in kernel code can lead to information disclosure or cause a kernel crash. The likely attack vector would be local, requiring the attacker to execute code that forces the kernel to parse a malicious IB, or remote if a graphics API interface can be coerced to provide such a buffer.