The Linux kernel’s AMD display driver parses a VBIOS table header to obtain a documented structure size, which drives a loop iterating over GPIO pin entries. The size field is not checked against the actual bounds of the mapped BIOS image; if the VBIOS reports a larger structure size than the data present, the loop reads past the image’s end. This CWE‑125 out‑of‑bounds read can expose kernel memory contents to an attacker, potentially leaking sensitive information and compromising confidentiality.

All Linux kernels built with the AMD display driver before the inclusion of commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3 are affected. Any system that loads a VBIOS image reporting an inflated structure size is vulnerable, regardless of distribution or kernel release. The fix is applied to all future kernel versions that incorporate the referenced commit.

The CVSS score of 7.8 denotes high severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves supplying a custom or tampered VBIOS image with a claimed structure size larger than the actual data, which typically requires physical or firmware‑level access to the system. Once the kernel processes the malformed table, it performs an out‑of‑bounds read that could leak memory contents to the attacker.