The Linux kernel’s DRM AMD KFD driver contains an integer overflow in the calculation of the command‑queue save‑restore area (CWSR) total size. The total size was computed using a 32‑bit type and later used as an allocation size. If the product of ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count overflows, the resulting buffer will be smaller than required, enabling firmware to overwrite memory beyond the allocated area. This can lead to a buffer overflow (CWE‑787), potentially corrupting kernel memory and creating a path for privilege escalation or system instability. The flaw exists in any Linux kernel that integrates the DRM AMD KFD driver before the patches in the advisory. No specific kernel release numbers are provided, so any system running a kernel prior to the referenced commits is considered vulnerable if it uses this subsystem.

All Linux kernel installations employing the DRM AMD KFD driver prior to the fix in commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608 are affected. The vulnerability is present in the kernel, regardless of specific version numbers, as long as the subsystem has not been patched. The patch promotes the 32‑bit calculation to 64‑bit and adds overflow checks in kfd_queue_acquire_buffers() and kfd_queue_release_buffers().

The CVSS score of 7.8 indicates high severity, while the EPSS probability of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. Based on the description, it is inferred that exploitation requires local privileged access to the kernel, implying that an attacker must already have significant kernel or local user privileges to trigger the overflow.