AMD Graphics Driver - integer overflow bypassing size checks: An integer overflow in the AMD graphics driver lets

Impact

An integer overflow in the AMD graphics driver lets an attacker wrap a size calculation and slip past the driver's own bounds checks. The advisory scopes the outcome to denial of service, but overflow-defeats-size-check is the standard front half of a heap corruption chain, so treat the ceiling as higher than the score.

Who can reach it

Local, via the graphics driver interface.

What to do

Update the AMD graphics driver and reload or reboot.

References

Related entries

• Linux cpufreq/amd-pstate - memory leak on CPU EPP exit: The amd-pstate driver leaks its per-CPU allocation when a CPU'sCVE-2024-40997 · Linux cpufreq/amd-pstate - memory leak on CPU EPP exitMedium
• Linux cpufreq/amd-pstate - unchecked cpufreq_cpu_get() return value: cpufreq_cpu_get() can return NULL and amd-pstateCVE-2024-50009 · Linux cpufreq/amd-pstate - unchecked cpufreq_cpu_get() return valueMedium
• Linux platform/x86/amd/pmc - IRQ1 wakeup disabled unconditionally: The AMD PMC driver disabled IRQ1 wakeup in casesCVE-2025-21645 · Linux platform/x86/amd/pmc - IRQ1 wakeup disabled unconditionallyMedium
• Linux cpufreq/amd-pstate - cpufreq_policy reference counting: amd_pstate_update_limits() takes a cpufreq_policyCVE-2025-21841 · Linux cpufreq/amd-pstate - cpufreq_policy reference countingMedium
• Linux cpufreq/amd-pstate - missing NULL check in amd_pstate_update: amd_pstate_update() dereferences the cpufreq policyCVE-2025-23137 · Linux cpufreq/amd-pstate - missing NULL check in amd_pstate_updateMedium
• Linux x86/CPU/AMD - INVLPGB on Zen 2 (Cyan Skillfish): Using broadcast TLB invalidation (INVLPGB) on affected Zen 2CVE-2025-38518 · Linux x86/CPU/AMD - INVLPGB on Zen 2 (Cyan Skillfish)Medium