This vulnerability involves an out-of-bounds write condition in the AMDGV_CMD_GET_DIAG_DATA ioctl handler of the AMD Instinct™ MI250 GPU. An attacker with local access and limited privileges could exploit this flaw to escalate privileges, potentially achieving remote code execution. The CVSS 4.0 score of 8.5 reflects high impact due to low attack complexity and no required user interaction, combined with high confidentiality, integrity, and availability impacts. The vulnerability is identified as CWE-787. No patch or official remediation level has been disclosed by AMD, and no exploits are currently known in the wild.

If exploited, this vulnerability could allow a local attacker to gain elevated privileges on the affected system, potentially leading to remote code execution. This could compromise system confidentiality, integrity, and availability. However, exploitation requires local access and the vulnerability is not currently known to be exploited in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been announced by AMD, users should monitor AMD's security advisories for updates. Until a patch is available, restricting local access to trusted users and minimizing exposure to untrusted local users may reduce risk.