The Linux kernel contains an out‑of‑bounds write flaw in the AMDGPU Video Code Engine driver caused by partial address patches. When only the low or high half of an address is validated during firmware patching, the driver writes an invalid address into the firmware image. This corruption can compromise firmware integrity and potentially lead to uncontrolled memory writes if the malformed firmware is later executed, presenting a severe integrity risk. The weakness is identified as CWE‑787, a classic out‑of‑bounds write vulnerability.

The flaw affects all Linux kernel builds that include the AMDGPU VCE component without the recent patch. As the CNA does not list specific kernel version numbers, it is inferred that any older kernel that ships with the vulnerable driver is susceptible. Systems running newer kernels that have incorporated the fix are not impacted.

With a CVSS score of 8.8, the vulnerability is classified as high‑severity. The EPSS score of less than 1 % indicates a very low current exploitation likelihood, and the flaw is not part of CISA’s KEV catalog. Exploitation would likely require local or kernel‑privileged access to manipulate firmware addressing, and no publicly available exploit has been reported. The risk remains high until the kernel is updated to a patched release. The likely attack vector is inferred as local or kernel‑privileged, because writing to firmware requires such privileges, but this is not explicitly stated in the input.