The flaw resides in the drm/amdkfd component of the Linux kernel, where get_wave_state() trusts attacker‑controlled values read from the GPU microcode on a CRIU‑restore path. This results in an unbounded copy_to_user() that can leak adjacent GTT and kernel memory, including KASLR pointers. The kernel may read far beyond the allocated buffer, enabling a large amount of kernel memory to be exposed, which constitutes a kernel‑level information‑disclosure vulnerability.

The vulnerability affects the Linux kernel DRM subsystem (amdkfd) on all architectures that support AMD GPU processes. Based on the description, it is inferred that any kernel version containing the amdkfd driver before the patch is potentially impacted. No specific kernel release or version range is listed in the CNA data.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score of 0.00124 shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have the ability to perform a CRIU‑restore of an AMDKFD process with a crafted microcode image, which limits the attack to a local or privileged user with control over the restore operation. The integer underflow can produce a read length of up to ~4 GiB, enabling a large amount of kernel memory to be exposed. The fix clamps the size and offset values before performing the copy, eliminating the out‑of‑bounds read.