The defect in the AMDGPU driver caused the UVD component to calculate an incorrectly small minimum frame buffer size for H264 streams. If the available video memory could not satisfy this underestimated size, the decoder would write beyond the allocated buffer. This could corrupt adjacent memory, lead to a kernel panic or, in the worst case, supply an attacker with a vector to execute arbitrary code. The correction indicates that the vulnerability was exploitable when a process was able to trigger H264 decoding. No public exploitation reports exist, and the vulnerability has been fixed in the upstream repository.

Any Linux kernel deployments that incorporated the AMDGPU UVD driver before the commit that introduced the size‑calculation fix. This includes all kernel releases below the version that includes commit 64b525e and any other builds that have not applied the patch. Users of older Linux kernels on AMD GPUs running H264 decoding workloads are potentially affected.

The CVSS and EPSS scores are not published, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The attack vector is inferred to be local, requiring an attacker to gain the ability to drive an H264 decode through the GPU interface, which typically requires code execution on the host. Because the flaw could cause memory corruption, there is a risk of a local privilege escalation or denial of service, but the likelihood of exploitation remains uncertain pending any future disclosure.