Linux kernel DRM driver for AMD GPUs (amdgpu VCE) contains an integer overflow in the calculation of image buffer size. Malicious VCE command streams with dimensions such as 65536×65536 cause a 32‑bit overflow that wraps the computed size to zero. This bypasses size validation and allows GPU firmware to perform out‑of‑bounds memory reads or writes, potentially leading to memory corruption or privilege escalation. The underlying weakness is an integer overflow that results in a buffer overflow.

All Linux kernel deployments that include the amdgpu driver with VCE support and that have not yet incorporated the patch committing to the 64‑bit check (e.g., kernels from the time of the original commit to the current unpatched release). Specific versions are not enumerated in the advisory, so any kernel lacking the commit ID cbe408dba581755ad1279a487ec786d8927d778d is considered affected.

The vulnerability enables an attacker to supply malformed VCE command streams that will be processed by the GPU firmware. Because the overflow occurs before kernel‑level bounds checking, memory corruption can happen at the GPU firmware level. The exploit is likely local or requires the attacker to be able to influence the VCE command stream; a remote exploit would require an additional vector to inject such streams. The advisory provides a CVSS score of 8.8, indicating high severity, and the EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, which suggests that no confirmed widespread exploitation has been reported at the time of the advisory.