A vulnerability in the Linux kernel AMDGPU driver allows a local authenticated attacker to trigger out-of-bounds memory access, resulting in potential information disclosure or denial of service.

The vulnerability exists within the SMU7 voltage lookup function of the AMDGPU driver. Improper validation of vddInd and vddcInd fields from VBIOS-parsed tables allows a local user with low privileges to index outside of defined memory bounds.

Successful exploitation requires local access and the ability to interact with the AMDGPU driver. While the CVSS score of 7.1 highlights a high severity, the requirement for local access somewhat limits the attack surface. However, the potential for information disclosure of sensitive kernel memory or system crashes could lead to significant service disruption and compromise of internal data integrity.

Immediate Action: Update the Linux kernel to the versions specified in the OSV fixed packages list (5.10.270, 5.15.221, 6.1.188, 6.6.157 or later) as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults related to the amdgpu module, which may indicate attempted exploitation.

Compensating Controls: Restrict access to the physical system and limit user permissions to prevent unauthorized execution of code or direct interaction with kernel-level hardware drivers.

Public Exploit Available: No

This vulnerability represents a significant risk to systems utilizing affected AMD graphics hardware due to the potential for kernel-level memory corruption. Security teams should prioritize patching the Linux kernel across all affected workstations and servers to eliminate this local attack vector. Ensure that kernel updates are validated in a staging environment before widespread deployment to maintain system stability.