The reported issue affects the AMD GPU device driver in the Linux kernel. A calculation of the DPB (Decoded Picture Buffer) size was performed without adequate bounds checks when a UVD (Unified Video Decoder) message referenced dimensions larger than 4096. The integer overflow in the DPB size could allow a malformed video stream to corrupt kernel memory or cause a division by zero, potentially resulting in a kernel panic. The patch rejects such messages, preventing the overflow and thereby safeguarding the kernel from unexpected crash or memory corruption.

All Linux kernel distributions that ship the amdgpu driver and lack the patch described in the commit logs are vulnerable. No specific version numbers are provided, but the vulnerability exists in any kernel where the amdgpu driver has not incorporated the change to reject large‑dimension UVD messages. The affected components are the kernel's DRM subsystem and the AMDUVD decoder path within the amdgpu module.

The CVSS score is not provided, and no EPSS score is available for this entry, so the quantitative risk assessment is limited. However, because the flaw is present in kernel‑level code and could trigger a memory corruption leading to a kernel panic, an attacker with the ability to inject a crafted UVD request could cause a denial of service. The KEV listing is absent, and no rumors of active exploitation exist as of the current data. The absence of a public exploit or high EPSS score suggests a lower immediate threat, but the kernel crash risk warrants timely resolution.