A vulnerability in the Linux kernel AMD display component could allow a local attacker with low privileges to trigger memory corruption and potential system instability.

The vulnerability exists because the dc_process_dmub_aux_transfer_async function fails to validate payload lengths and link indices before copying data into a fixed size stack buffer. This allows an attacker with low privileges to trigger a stack buffer overflow or perform an out of bounds memory access, as the existing validation mechanism is merely an assertion that is disabled in production builds.

The potential for stack based buffer overflows and out of bounds access poses a significant risk to system integrity and availability. While the attack requires local access and low privileges, successful exploitation could lead to privilege escalation, arbitrary code execution, or denial of service through kernel panic. Given the CVSS score of 7.0, this is classified as a high severity risk that requires prompt patching to maintain overall system security posture.

Immediate Action: Update the Linux kernel to version 5.15.209, 6.1.175, 6.6.142, 6.12.92, or later, depending on your current distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process terminations that may indicate memory corruption attempts.

Compensating Controls: Ensure that access to the system is strictly limited to authorized personnel to mitigate the risk of local exploitation. Implement hardware and software security policies that restrict unprivileged user access to sensitive display and driver interfaces.

Public Exploit Available: Unknown

This vulnerability represents a critical stability and security risk to Linux systems utilizing the AMD display driver. Administrators should prioritize testing and deploying the provided kernel updates across their environments. Applying these patches is essential to mitigate the risk of local memory corruption attacks that could compromise the entire operating system.