The Linux kernel contained a vulnerability in the drm/amdgpu/vce driver where partial address patches could lead to writing bad addresses in firmware if only one of the low or high address parts was valid. This could cause serious security issues including potential privilege escalation or system compromise. The issue is fixed in Linux kernel versions 6.8.0-1061.64~22.04.1 and later. The CVSS 3.1 score is 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating a local attacker with low privileges could exploit this vulnerability to cause complete confidentiality, integrity, and availability loss with no user interaction. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to the specified fixed versions. The advisory also notes a required reboot and recompilation of third-party kernel modules due to ABI changes.

This vulnerability allows a local attacker with low privileges to cause severe impact including complete loss of confidentiality, integrity, and availability of the affected system. Exploitation could lead to firmware corruption or other critical failures in the AMD GPU driver subsystem. The high CVSS score reflects the critical nature of the flaw. No known exploits in the wild have been reported at this time.

A patch is available and included in Linux kernel versions 6.8.0-1061.64~22.04.1 and later. Users should update their Linux kernel to these or newer versions as provided by their distribution vendor. After updating, a system reboot is required to apply the changes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating and rebuilding kernel modules. No additional mitigation steps are indicated by the vendor.