A vulnerability in the Linux kernel amdgpu VCE driver could allow a local attacker to cause memory corruption or influence firmware operations.

This is a memory corruption vulnerability in the drm/amdgpu/vce driver component. The issue stems from improper handling of partial address patches, allowing a low-privileged local user (PR:L) to trigger writes to invalid addresses within the firmware.

The CVSS score of 8.8 reflects the high risk of this vulnerability. Successful exploitation could lead to privilege escalation or a crash of the graphics subsystem, potentially affecting overall system stability and data integrity.

Immediate Action: Update the Linux kernel to version 6.1.175, 6.6.140, 6.12.90, 6.18.32, or later stable releases.

Proactive Monitoring: Monitor logs for VCE firmware errors or unexpected hardware exceptions related to the amdgpu driver.

Compensating Controls: Enforce the principle of least privilege for local users to limit the ability to interact with vulnerable graphics drivers.

Public Exploit Available: No

System administrators must prioritize updating the Linux kernel on all machines utilizing AMD VCE hardware. Because this vulnerability allows for kernel-level memory manipulation, immediate application of the vendor-provided security patches is required.