AMD Instinct GPU driver: out-of-bounds write in the diagnostic-data ioctl grants privilege escalation

CVSS 8.5CVE-2025-54517NVIDIA / GPU stackcurated

Impact

A local user able to issue ioctls to the AMD GPU virtualization driver can write outside bounds in the AMDGV_CMD_GET_DIAG_DATA handler and escalate privileges with code execution in the driver's context. On a GPU node this is the boundary that separates a tenant workload from the host: the affected parts are the datacenter Instinct line (MI210/MI250/MI300A/MI300X/MI308X/MI325X) and Radeon PRO V620, so the blast radius is a node carrying other tenants' jobs and, in a vGPU deployment, the component that is supposed to keep guests apart. AMD rates it 8.5 with high confidentiality, integrity and availability impact and no user interaction.

Who can reach it

Local, authenticated low-privileged user on the host (or in a context holding the GPU device nodes) that can reach the AMD GPU driver ioctl interface. No network exposure.

What to do

Apply the driver/GIM update referenced in AMD bulletin AMD-SB-6027 for the affected Instinct and Radeon PRO V620 platforms. Loading a new GPU kernel driver means draining the node's workloads and reloading the module or rebooting - plan a maintenance window per node; on a virtualized host the guests must be stopped as well. Until then, restrict which tenants and containers get the GPU device nodes.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-54517 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.