The Linux kernel's AMDGPU driver had a vulnerability where stale write pointer mappings could be accessed due to improper locking during queue creation. Specifically, the fix involved using drm_exec to take both vm root buffer object and wptr_obj buffer object locks to properly access mapping data. This prevents the security issue where the wptr_obj could be unmapped while a queue creation was in progress, potentially allowing other buffer objects at the same address to be passed incorrectly. The fix was cherry-picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c and is included in linux-hwe-edge versions 7.0.0-28.28.1 and later.

The vulnerability could allow improper access to stale or unmapped buffer objects during queue creation in the AMDGPU driver, potentially leading to security issues related to memory mapping corruption or unauthorized access. The CVSS 4.0 vector indicates local attack vector with low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

A fix is available in linux-hwe-edge versions 7.0.0-28.28.1 and later. Users should update to these or newer versions to remediate the vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended mitigation.