The Linux kernel’s KFD DRM module lacked bounds checks for the queue type and mqd_size parameters supplied during a CRIU restore. If an attacker supplies values that exceed the expected limits, the kernel may write out of bounds, leading to memory corruption, an unexpected crash, or other unpredictable kernel behavior. This vulnerability directly impacts kernel stability and data integrity.

All Linux kernel builds that include the KFD DRM module before the inclusion of commit f19d8086f6644083c913d70bfdeee20e1b6f46a5 are affected. Because the affected module is part of the core DRM subsystem, any distribution or custom kernel containing that code path is potentially vulnerable.

The CVSS score of 7.1 indicates high severity, but the EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, suggesting limited current exploitation. An attacker who can control the contents of a CRIU restore file—typically a local user or a privileged process—could trigger the unchecked bounds and cause kernel memory corruption or a crash, resulting in denial of service or a possible escalation path if combined with other weaknesses. The vulnerability requires local access to the CRIU restore process and is not remotely exploitable without further privileges.