The Linux kernel's DRM amdkfd module had no upper bound check for the num_of_nodes parameter in the ioctl handler kfd_ioctl_get_process_apertures_new. This omission allows a user with access to the KFD interface to perform an out-of-bounds read of kernel memory, potentially exposing kernel data or causing a kernel panic that results in denial of service. The weakness is classified as an out-of-bounds read, CWE‑125.

All systems running a Linux kernel version before the commit that introduced the bound check are vulnerable. Since the change is in the mainline kernel, any distribution shipping an older kernel remains at risk until the update is applied. The affected kernel component is the DRM amdkfd module of the Linux kernel.

The likely attack vector is local, requiring interaction with the KFD ioctl interface. The EPSS score of less than 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects moderate severity, suggesting that successful exploitation would lead to service disruption but is unlikely to result in privilege escalation or remote compromise. An attacker would need local access or privileged ability to invoke the KFD call, so the risk is primarily for compromised or stolen hosts.