In the Linux kernel AMDGPU driver, the uvd/vce/vcn components access instruction buffers without first verifying that the buffer is large enough. This missing bounds check permits the kernel to read or write memory beyond the intended buffer boundaries, corrupting kernel memory. The fix introduces explicit bounds verification and changes the index type to an unsigned 32‑bit value to prevent overflow conditions that could bypass the check. If exploited, an attacker able to invoke this code locally could achieve arbitrary kernel‑level code execution and elevate privileges to root on the affected system.

All Linux kernel builds that include the AMDGPU driver and its uvd, vce, and vcn components are affected if they have not yet received the bounds‑checking update. No specific version range is cited, so any system running a kernel with this driver before the patch is at risk.

The EPSS score of 0.00018 (<1%) indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. This is a local kernel vulnerability; the attacker requires local access to the machine. A successful exploit could grant root privileges, but the low EPSS score and absence from KEV imply that the risk remains moderate for most organizations while recognizing the potentially high impact if exploited.