The AMDKFD DRM driver in the Linux kernel parses CRAT tables without verifying that the advertised subtype length stays within the image bounds. If an attacker supplies a CRAT with an inflated length field, the parser casts the header to subtype structures and reads beyond the image, exposing kernel memory content. This improper bounds validation can lead to information disclosure and, when combined with other local vulnerabilities, may facilitate privilege escalation.

This flaw affects any Linux kernel that still uses the AMDKFD driver without the bounds-check commit referenced in the kernel changeset. No specific version lock-down exists in the data; therefore, any unpatched kernel build vulnerable to the missing check is at risk.

The CVSS score of 8.0 indicates high severity, and the EPSS score of < 1% suggests a low probability of exploitation in the wild. The vulnerability resides in the local AMDKFD driver; an attacker would need to supply a malformed CRAT table, likely through a local privileged context or by injecting GPU firmware data. The out-of-bounds read may leak kernel memory, and when combined with other weaknesses could enable privilege escalation. The flaw is not listed in CISA's KEV catalog.