The vulnerability resides in the AMDGPU driver within the Linux kernel. During the GEM_OP GET_MAPPING_INFO DRM operation, a user‑supplied num_entries value is passed to kvcalloc without validating its size. Because num_entries is a 32‑bit unsigned integer and each entry occupies 32 bytes, a large num_entries can cause the allocation size to exceed INT_MAX, leading to a kernel warning, TAINT_WARN and, on systems with CONFIG_PANIC_ON_WARN set, a kernel panic. This flaw exemplifies CWE‑190: Integer Overflow or Wraparound, and results in a denial of service but does not directly compromise confidentiality or integrity.

All Linux kernels that include the drm/amdgpu driver before the commit introducing a size bounds check are affected. This includes every Linux distribution shipping such a kernel. Any system running this kernel, regardless of manufacturer, is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % and absence from CISA’s KEV catalog suggest a low likelihood of widespread exploitation. Based on the description, it is inferred that attackers would need to invoke the GEM_OP GET_MAPPING_INFO DRM operation with a crafted num_entries value. This operation typically requires local access to the graphics device, making the attack vector local rather than remote. The exploit requires privilege to execute privileged firmware code, and therefore is less attractive to remote attackers. The applied patch mitigates the issue by rejecting oversized num_entries early with an error code, preventing the out‑of‑bounds allocation.