The vulnerability is an integer overflow in the get_queue_ids() function of the drm/amdkfd module. The function calculates an array size by multiplying num_queues by the size of a 32‑bit integer, which on 32‑bit builds can exceed the maximum value representable by the 32‑bit size_t type. If the multiplication wraps, the code will allocate a smaller array than intended. This overflow could lead to a kernel buffer overrun, potentially corrupting memory and causing instability or erratic behavior. The fix saturates the calculated size to SIZE_MAX on overflow.

All Linux kernel builds containing the drm/amdkfd kfd debugger as distributed before the patch commit. The vulnerability exists in any kernel that shipped with the original get_queue_ids implementation, regardless of architecture.

The CVSS base score of 7.8 reflects a high‑severity flaw. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild at this time, and the flaw is not listed in the CISA KEV catalog. The attack vector likely requires local privileged or kernel interface access to the kfd debugger. Given the low exploitation likelihood, the risk is moderate, but the severity suggests that the flaw should be remediated promptly when an update is available.