The AMDGPU DRM driver incorrectly handled the size field of the GPIO I2C table supplied by the VBIOS. Because the code did not apply a proper upper bound, a table that claimed more entries than the driver actually allocated could cause the i2c_bus array to be indexed past its bounds. This out-of-bounds write can corrupt kernel memory or trigger an immediate crash, compromising the confidentiality, integrity, or availability of the entire system. The flaw is categorized as an out-of-bounds write (CWE-787).

The vulnerability exists in all Linux kernel releases that include the buggy AMDGPU driver code before the patch that caps the derived entry count to AMDGPU_MAX_I2C_BUS. This includes every distribution kernel using the default driver shipped with the kernel, regardless of distribution name or version, until the relevant commit is applied.

The CVSS base score for this issue is 7.0, and the EPSS score is below 1%, indicating a low likelihood of exploitation. No public exploits are listed in the CISA KEV catalog. The likely attack vector is a local or firmware-based attack that requires a corrupted or malicious VBIOS image to be loaded at boot or during AMDGPU driver initialization. Because the flaw hinges on privileged firmware, the risk is moderate until a kernel update is applied, but a successful attack could cause kernel corruption or denial of service.