CVE-2024-46722

What it actually does

Out-of-bounds array read of mc_data[i-1] in the amdgpu DRM driver that triggers a static analysis warning for potential memory corruption.

Why it matters to the business

Linux systems using AMD GPUs may experience driver instability or crash risk until patched; the large number of downstream dependents increases exposure across kernel deployments.

How an attack unfolds

An attacker with local access triggers the amdgpu code path that indexes mc_data without proper bounds checking, potentially reading adjacent kernel memory; listed threat actors have shown interest in similar Linux kernel memory issues but no public exploitation of this specific flaw is recorded.

How to fix it

Update the Linux kernel to commit 5fa4df25ecfc7b6c9006f5b871c46cfe25ea8826 or later; for github.com/fluid-cloudnative/fluid update to version 0.9.3 or newer.

How to confirm the fix worked

Confirm the applied kernel tree contains commit 5fa4df25ecfc7b6c9006f5b871c46cfe25ea8826 and that the static analyzer warning for mc_data out-of-bounds access is no longer emitted.

Typical attack path

1. Obtain local code execution on a target Linux system with AMD GPU
2. Trigger the drm/amdgpu initialization or reset sequence that performs the mc_data read
3. Read or influence kernel memory adjacent to the mc_data array
4. Escalate to denial of service or limited information disclosure

How to detect it

Review kernel logs for amdgpu driver warnings referencing mc_data array access; examine crash dumps or memory instrumentation reports for out-of-bounds reads in drm/amdgpu paths.

What your security team should do

• Prioritize kernel upgrades on all AMD GPU hosts within standard change windows
• Add the fixed commit hash to patch-management and SBOM tracking
• Monitor EPSS and threat-intel feeds for any future rise in exploitation of similar amdgpu issues