In the Linux kernel's AMDGPU driver, the parsing of FRU PIA data relied on an unbounded TLV walk that allowed out-of-bounds reads when supplied with truncated or malformed FRU data, exposing kernel memory and potentially enabling privilege escalation. This is a classic buffer over-read flaw (CWE-119) caused by missing bounds checks on EEPROM data reads.

All versions of the Linux kernel containing the AMDGPU driver before commit c990c05eb6c74c98d1ff3acf67a19015312820b7 are affected. This includes any kernel that loads the AMDGPU driver for AMD GPUs and can receive FRU firmware from the device.

The vulnerability’s severity is not quantified with a CVSS score; however, it permits local or privileged attackers to read beyond a defined EEPROM buffer, potentially leaking sensitive information. The attack requires the attacker to supply malformed FRU firmware to the AMDGPU driver, which could be achieved by manipulating firmware on the device or injecting custom data into the driver’s parsing routine. This typically necessitates physical access to the GPU or control over firmware storage mechanisms. Exploit likelihood appears low as the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, it remains a serious local issue until the kernel is patched, because any such out-of-bounds read could compromise kernel memory integrity and confidentiality.