The vulnerability arises from missing bounds checks on the queue type and mqd_size values supplied during a CRIU restore in the Linux kernel’s KFD DRM module. Without these validations, an attacker could provide malformed data that leads to undefined kernel behavior, potentially causing memory corruption or a kernel crash. This flaw does not explicitly guarantee privilege escalation, but the kernel-level impact could be leveraged by a skilled adversary to disrupt system operation or gain higher privileges if combined with other weaknesses.

All Linux kernel builds that include the KFD DRM module prior to the patch are affected; specific version numbers are not listed in the CNA data, so any kernel compiled with this code path before the fix may be vulnerable. The impact applies to the entire Linux kernel operating system.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no current widespread exploitation. The CVSS score of 7.1 indicates high severity. The lack of bounds checks in a critical kernel routine means that an attacker who can influence CRIU restore parameters could cause kernel memory corruption or a crash. Likely attack vectors involve a local user or privileged process creating a malicious CRIU restore file; successful exploitation could lead to system instability or, with additional vulnerabilities, privilege escalation.