The flaw lies in the DRM/AMDKFD event allocation routine which allows an attacker to pass an event ID that exceeds the defined limit, as the code fails to enforce an upper bound check. If an invalid event ID is supplied, the kernel may allocate an out‑of‑range slot, corrupting kernel memory, triggering a crash, or enabling an attacker who can gain local code execution to elevate privileges. The vulnerability is a classic bounds checking omission that can lead to kernel corruption.

All Linux kernel installations that contain the earlier version of the DRM/AMDKFD driver before the commit that added the bounds check. The vulnerability is documented for the kernel repository and therefore impacts any distribution that has not upgraded past the affected commit. No specific kernel release numbers are listed, but any release pulled from the mainline kernel prior to the fix is potentially vulnerable.

A lack of an EPSS score or CVSS rating in the available data means the exact exploitation likelihood cannot be quantified. However, missing bounds checks in kernel code are a high‑severity security issue, and the fact that the flaw allows out‑of‑range event IDs means local exploitation could be achieved by any process able to influence the DRM/AMDKFD API, potentially leading to full privilege escalation or system instability. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers would likely need local access and the ability to invoke allocate_event_notification_slot, as the issue is tied to a specific kernel driver function.