A stack AMD display driver when dc_process_dmub_aux_transfer_async copies a payload whose length exceeds 16 bytes into a 16‑byte stack buffer guarded only by an ASSERT that is a no‑op in release builds. Additionally, link_index is used to index the dc->links[] array without bounds checking, risking an out‑of‑bounds access. If triggered successfully, these defects can corrupt kernel memory and enable an attacker to execute arbitrary code in the context of the kernel.

The flaw resides in the Linux kernel’s AMD display driver (drm/amd/display). All Linux kernel versions built before the inclusion of commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881 are affected. No specific vendor product names beyond the Linux kernel are mentioned, so any system running an unpatched kernel that includes this driver is at risk.

The EPSS score is reported as less than 1 percent, indicating a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While the flaw is a kernel‑space buffer overflow, its exploitation requires gaining the ability to invoke the vulnerable function, which typically means possessing load a malicious module. The likely attack vector is local; remote exploitation would depend on additional indirect vulnerabilities that could lead to kernel execution. Once the kernel is patched to include the runtime check and bound checking, the vulnerability is mitigated.