The Linux kernel’s AMDKFD driver contains a flaw in the allocate_sdma_queue routine, which accepts an SDMA queue identifier supplied by external components such as CRIU without validating that the value falls within the allowed range. The absence of bounds checking allows an out‑of‑bounds index to be used when allocating or referencing the SDMA queue, leading to kernel memory corruption, crash, or service interruption.

All Linux kernel releases that include the AMDKFD DRM driver and were built before the commit that added the bounds check are impacted. Since the data provides only a generic Linux kernel CPE string and does not list specific vendor or product names, this assessment is inferred from the kernel’s status and may differ across distributions. Operators should verify whether their current kernel predates the fix.

The flaw is not listed in the CISA KEV catalog and has an EPSS score of <1%, indicating a low likelihood of exploitation. However, its CVSS score of 7.8 reflects a high severity that could allow kernel memory corruption. Based on the description, it is inferred that the attack vector could involve a component such as CRIU that supplies a user‑defined SDMA queue ID with sufficient privileges; if successful, the exploit could corrupt kernel memory, leading to denial of service or, with privilege escalation, full system compromise. No public exploits have been reported, so the risk remains theoretical but significant.