CVE-2025-52532: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in AMD AMD Radeon™ PRO V620
A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an attacker to trigger a heap-based buffer overflow, potentially resulting in denial-of-service within the vulnerable system context.
AI Analysis
Technical Summary
This vulnerability is a TOCTOU race condition (CWE-367) in the ioctl path of the MxGPU-Virtualization driver for AMD Radeon™ PRO V620. Concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler can be exploited to trigger a heap-based buffer overflow. The CVSS 4.0 base score is 2.0, indicating low severity. The vulnerability could result in denial-of-service but does not appear to allow privilege escalation or code execution. No patch or official remediation level has been published by AMD as of the data provided.
Potential Impact
The primary impact is a potential denial-of-service condition caused by a heap-based buffer overflow triggered through a race condition in the driver. The vulnerability requires local access with low privileges and high attack complexity, limiting its exploitability. There is no indication of remote exploitation or impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limiting access to the vulnerable driver and avoiding concurrent ioctl calls that could trigger the race condition may reduce risk. Monitor AMD advisories for updates.
CVE-2025-52532: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in AMD AMD Radeon™ PRO V620
Description
A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an attacker to trigger a heap-based buffer overflow, potentially resulting in denial-of-service within the vulnerable system context.
CVSS v4.0
Score 2.0low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a TOCTOU race condition (CWE-367) in the ioctl path of the MxGPU-Virtualization driver for AMD Radeon™ PRO V620. Concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler can be exploited to trigger a heap-based buffer overflow. The CVSS 4.0 base score is 2.0, indicating low severity. The vulnerability could result in denial-of-service but does not appear to allow privilege escalation or code execution. No patch or official remediation level has been published by AMD as of the data provided.
Potential Impact
The primary impact is a potential denial-of-service condition caused by a heap-based buffer overflow triggered through a race condition in the driver. The vulnerability requires local access with low privileges and high attack complexity, limiting its exploitability. There is no indication of remote exploitation or impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limiting access to the vulnerable driver and avoiding concurrent ioctl calls that could trigger the race condition may reduce risk. Monitor AMD advisories for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMD
- Date Reserved
- 2025-06-17T16:53:10.412Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a069f5eec166c07b0ad36d7
Added to database: 05/15/2026, 04:21:50 UTC
Last enriched: 05/15/2026, 04:37:00 UTC
Last updated: 07/31/2026, 19:22:55 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.