In the Linux kernel, the DRM AMDKFD subsystem contains a race condition where the event counter and walk of event identifiers are performed without holding the required event mutex. If an event is added or removed between the count and the walk, the routine writes past the end of the allocated buffer or dereferences a freed entry. This can corrupt kernel memory and, based on the description, it is inferred that this may enable an attacker to gain control authority. The weakness is a classic synchronization race leading to out‑of‑bounds writes or use‑after‑free, classified as a memory corruption flaw.

All Linux hosts running a kernel that includes the drm/amdkfd driver are potentially affected. The description does not specify exact version ranges, but any kernel prior to the commit that introduced the fix (ff57e223ab 2026) is at risk. Based on the description, it is inferred that the driver is part of the AMD GPU subsystem, so systems with AMD GPUs and the associated kfd infrastructure are the most relevant targets.

The CVSS score is 7.8, and the EPSS score is <1%, so the overall risk is moderate to high, but exploitation probability remains low. The flaw is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an intra‑process race that requires the attacker to trigger a CRIU checkpoint operation while concurrently creating or destroying events. This suggests a local privilege escalation scenario, though exploitation from a remote user would require additional capabilities to influence the same process. Based on the description, it is inferred that the out‑of‑bounds nature of the bug could lead to kernel panic or arbitrary code execution if the attacker can manipulate the data written or read during the race.