Technical impact
The amdgpu driver accepted a user‑supplied IB byte count without validating that it remained within the ring’s packet‑size limits. When excessively large values were passed, the driver encoded the length into packet fields that could overflow adjacent control bits. This overflow can corrupt kernel memory and destabilize command submission, which in turn can provide a local attacker the ability to corrupt kernel state.
Affected Systems
The Linux kernel builds that include the amdgpu DRM subsystem without the per‑ring IB packet‑size limit check are affected. No specific version information is supplied, so the flaw likely exists in all current kernel releases that expose the AMDGPU device to user space and allow GPU command submission. The lack of affected‑version details must be noted explicitly.
Risk and Exploitability
The flaw requires access to the AMDGPU device for command submission; thus it is a local‑attacker scenario. The EPSS score of < 1% indicates a very low probability of exploitation, while the CVSS score of 8.8 indicates high severity, and the vulnerability has not been reported in the KEV list. The exploitation vector involves crafting an oversized IB to trigger the overflow, leading to kernel corruption. While the chance of immediate exploitation may be low given the EPSS, local users with GPU access could abuse the flaw, rendering the risk significant but contingent upon local privileges.
Debian DLA
Ubuntu USN