The kfd_ioctl_get_process_apertures_new handler in the DRM amdkfd module of the Linux kernel lacks an upper bound check for the num_of_nodes parameter. This omission permits an attacker to read beyond the intended buffer, potentially exposing kernel memory contents or causing a kernel panic. The consequence is a loss of system availability and possible leakage of sensitive data at the kernel level. This weakness is a classic out-of-bounds read (CWE‑125).

All Linux kernel releases prior to the commit that introduced the bound check are affected. Since the commit resides in the mainline kernel, any vendor shipping a kernel version that does not yet incorporate this change—i.e., kernels older than the patched flavor—remains vulnerable. The patch is relevant to the standard Linux kernel and its derivatives.

Based on the description, it is inferred that the attack vector requires local interaction with the KFD ioctl interface. The EPSS score is reported as less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a low exploitation probability. The attack requires local user privileges or the ability to invoke the KFD ioctl interface, so an attacker would need to gain local access to the target machine. While the risk is moderate due to limited attack vector and low available exploits, a successful exploitation would still cause a denial of service or data exposure at the kernel level.