A 32‑bit overflow in the calculation of the end‑of‑packet (EOP) ring buffer size in the AMD KFD driver allows a user process to supply a size that wraps to zero. The subsequent size check in kfd_queue_buffer_get() is bypassed, enabling the mapping of an arbitrary buffer object (BO) at the requested address. When the GPU accesses this oversized buffer, the CP writes may exceed the allocated 4 KB backing buffer that was configured for an 8 KB ring, potentially corrupting kernel memory or causing a GPU fault. The vulnerability therefore exposes a local user to kernel memory corruption that could lead to privileged escalation or denial of service, depending on exploitation success.

This weakness exists in the Linux kernel’s drm/amdkfd component, which supports AMD GPUs. No specific kernel revision range is listed, but the issue was fixed in the commit referenced in the advisory; any kernel using a pre‑fix version of the KFD driver is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity risk, and the EPSS score is <1%. The vulnerability requires local user access to a system with an AMD GPU and the ability to issue KFD API calls. No public exploits are documented and the flaw is not listed in CISA’s KEV catalog. However, the nature of the bug—an unchecked buffer size leading to memory corruption—suggests a high impact if successfully exploited.