A heap overflow exists in the Linux kernel’s AMD DRM powerplay code. When a user writes to a sysfs attribute the function pp_dpm_set_pp_table() copies up to PAGE_SIZE bytes into a heap buffer that was allocated only to soft_pp_table_size. The overflow can corrupt adjacent kernel memory, which may cause a crash or, if the attacker can control the overflow data, lead to privilege escalation.

All versions of the Linux kernel contain the vulnerable drm/amd/pm module. No specific version list is available; the bug is present in the kernel source for all releases until the patch applied in commit 33...

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The CVSS score of 7.0 indicates medium severity, and because the flaw is a heap overflow that can corrupt kernel memory, the risk of a successful exploitation is significant. Attackers need local write access to the relevant sysfs entry, so the attack vector is a local user or a privileged process.