The vulnerability resides in the Linux kernel’s drm/amdkfd driver and occurs when the CRIU checkpoint routine copies the MQD control stack using a hardware‑supplied size without bounding it to the allocated buffer object (BO) region. If the hardware value exceeds the BO allocation, the memcpy operation reads past the GTT memory and can leak kernel data to user space. This constitutes an out‑of‑bounds read (CWE‑125) that results in information disclosure.

Linux kernel implementations that include the drm/amdkfd driver before the inclusion of commit 6c2abd0ec09e86c6323010673766f76050e28aa3 are affected. Any distribution running an unpatched kernel version exposes the risk of kernel data leakage via the DRM subsystem’s CRIU checkpoint functionality.

The CVSS score of 7.1 indicates high severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to trigger a CRIU checkpoint on a DRM device, a privilege that typically requires local or system‑level access; this inference is based on how the CRIU checkpoint is normally invoked. The impact is solely confidentiality damage, allowing an attacker to read kernel memory. While no remote code execution is possible, the exposed data could support a broader compromise. The overall risk is moderate for unpatched systems but substantially mitigated once the kernel is updated to include the control‑size clamping fix.