A vulnerability in the Linux kernel AMDGPU driver for Vega10 hardware could allow an authenticated local user to impact system stability or gain unauthorized information access.

The vulnerability exists within the powerplay component of the AMDGPU driver, specifically due to a lack of bounds checking when indexing into VBIOS-parsed voltage tables (vddc, vddci, and vddmem). An attacker with local access and low privileges can exploit this to perform out-of-bounds memory operations.

The potential consequences include system crashes resulting in denial of service and the risk of unauthorized memory disclosure. With a CVSS score of 7.3, this flaw is considered high severity, as it enables a local user to escalate their capabilities and potentially compromise the integrity of the host system.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults occurring within the amdgpu module, which may indicate attempted exploitation.

Compensating Controls: Restrict access to the graphics hardware device nodes (e.g., /dev/dri/renderD*) to only authorized users or groups to prevent non-privileged attackers from interacting with the vulnerable driver.

Public Exploit Available: Unknown

The risk posed by this kernel vulnerability is significant for environments utilizing AMD Vega10 hardware. Administrators should prioritize patching the kernel across all affected systems to prevent potential local privilege escalation and system instability. Ensure that standard security hygiene, such as limiting local user access, is enforced while awaiting the deployment of vendor-supplied kernel updates.