The vulnerability is in the AMDGPU display driver’s dal_vector_reserve function, which calculates an allocation size using 32‑bit arithmetic. If the calculated capacity overflows, krealloc may allocate a buffer smaller than requested, creating a heap overflow when subsequent vectors are appended. This can corrupt kernel memory, potentially exposing privileged data, modifying kernel state, or causing a denial of service. The flaw is classified as CWE-787: Uncontrolled Memory Allocation, CWE-674: Integer Overflow or Wraparound, and CWE-190.

Linux kernels that include the AMDGPU driver before the commit 37668568641ccc4cc1dbca4923d0a16609dd5707 are affected. Distribution kernels shipping any such pre‑patch version are vulnerable until that commit or a backport is applied.

The CVSS score of 7 indicates a high severity vulnerability, while the EPSS score of < 1 % suggests a very low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that successful exploitation requires local or privileged execution that can interact with the AMDGPU driver, for example by loading malicious firmware or sending crafted GPU commands. If exploited, kernel memory corruption could lead to privilege escalation or denial of service.