The Linux kernel amdkfd driver allows an allocated doorbell identifier to be set to a specific value supplied by a caller, a feature used by CRIU. The code that performs this operation does not validate that the requested identifier is less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS. An attacker who can instruct the kernel to allocate a doorbell with an out‑of‑range value can cause an out‑of‑bounds write, corrupting kernel memory and potentially enabling arbitrary code execution or other privileged actions. This flaw is characterized by missing bounds checking, which is a classic attack surface for memory corruption vulnerabilities.

All Linux kernel builds that include the amdkfd driver without the bounds‑check patch are affected. Because the CPE entry covers all linux_kernel versions and no explicit version range is given, every distribution shipping a kernel prior to the commit that added the verification is vulnerable. The issue is present in any standard kernel that ships with an amdkfd module and has not been updated to include the patch.

The CVSS score of 7.0 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw operates in kernel space, giving an attacker the ability to corrupt privileged memory if they can invoke allocate_doorbell with an arbitrary identifier. The lack of bounds enforcement means that an attacker who can control the doorbell ID can potentially escape to kernel mode or crash the system, but the practical attack surface requires some form of privileged or specially‑configured application such as CRIU.