CVE-2024-39471

What it actually does

Missing error check after sdma_v4_0_irq_id_to_seq allows out-of-bounds read in the amdgpu SDMA IRQ path when -EINVAL is returned.

Why it matters to the business

Local users on Linux systems with AMD GPUs can trigger kernel memory reads or crashes, risking data exposure and denial of service on affected servers and workstations.

How an attack unfolds

An attacker with local access supplies an invalid IRQ identifier to the AMDGPU driver; the unchecked error return causes the kernel to index an array out of bounds, resulting in an information leak or crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 5594971e02764aa1c8210ffb838cb4e7897716e8 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the presence of the error-handling return after sdma_v4_0_irq_id_to_seq in the amdgpu SDMA IRQ source; verify running kernel version includes the referenced commit.

Typical attack path

1. Obtain local user access on a Linux system with AMDGPU hardware
2. Trigger SDMA IRQ handling with an invalid IRQ ID value
3. Force sdma_v4_0_irq_id_to_seq to return -EINVAL
4. Read kernel memory via the resulting out-of-bounds access or crash the system

How to detect it

Review kernel logs for amdgpu SDMA IRQ errors or unexpected oops/panic traces around IRQ handling; correlate with local user activity on systems running vulnerable kernels.

What your security team should do

• Apply the kernel update containing commit 5594971e02764aa1c8210ffb838cb4e7897716e8 as soon as possible on all AMDGPU systems
• Prioritize patching of multi-user and server environments first
• Monitor for local privilege-escalation attempts while rollout completes