This vulnerability (CVE-2026-0427) affects the AMD Instinct™ MI210 GPU firmware where shared register resources are not properly cleaned up between guest virtual machines. An attacker with admin privileges in one guest VM could access these shared resources in another guest VM, potentially compromising confidentiality, integrity, or availability. The CVSS 4.0 base score is 4.6, indicating medium severity with local attack vector, low complexity, and no user interaction required. The vulnerability is classified under CWE-459 (Incomplete Cleanup). No patch or official remediation level has been provided by AMD as of the publication date.

The vulnerability allows an admin-privileged attacker within a guest VM to access shared GPU register resources from another guest VM, potentially leading to unauthorized data access or interference with the other VM's operations. This could result in loss of confidentiality, integrity, or availability of information processed by the affected GPU. However, exploitation requires high privileges within a guest VM and local access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published by AMD, users should monitor AMD advisories for updates. Until a patch is available, restrict administrative access within guest VMs to trusted users only to reduce risk.