Linux Kernel EUVD-2026-59564

The target system must have a legacy ATI/AMD Radeon GPU with the radeon kernel DRM module loaded and active - this driver covers pre-GCN and early-GCN era hardware and is distinct from the modern amdgpu driver. The attacker must hold a local user account with read/write access to the DRM device node (/dev/dri/card* or /dev/dri/renderD*), which typically requires membership in the 'video' or 'render' system group. The overflow is triggered by issuing DRM_IOCTL_MODE_CREATE_DUMB with attacker-controlled width and bpp parameters. The CVSS vector PR:L confirms a minimum of a low-privilege local account is required; unauthenticated or remote exploitation is not possible. Exploitation is further bounded to the subset of Linux deployments where legacy Radeon hardware is present and the radeon module is loaded - systems running amdgpu, i915, nouveau, or no discrete GPU driver are not in scope.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a realistic local threat: any user with DRM device node access can trigger the overflow without elevated privileges or user interaction, and with low attack complexity. The C:H/I:H/A:H impact ratings presuppose the overflow can be weaponized as a heap corruption primitive leading to privilege escalation; this is plausible given the kernel allocation context but has not been confirmed by published exploitation research or a public PoC. EPSS at 0.16% (5th percentile) is very low, consistent with the absence of KEV listing and no known active exploitation - the high CVSS score here is driven by the theoretical worst-case memory corruption impact, not observed real-world risk. The hardware prerequisite (legacy Radeon GPU with radeon module loaded) substantially limits the exposed attack surface: modern production servers and desktops overwhelmingly use amdgpu or NVIDIA/Intel drivers. Net assessment: low urgency for most environments, elevated for shared multi-user systems with legacy Radeon hardware where untrusted local users have DRM access.

A local user on a shared Linux system with a legacy Radeon GPU (e.g., an old workstation or thin client) issues a DRM_IOCTL_MODE_CREATE_DUMB ioctl with a crafted width and bytes-per-pixel combination selected to wrap the signed integer arithmetic in radeon_align_pitch(), causing the kernel to allocate a zero-sized or dramatically undersized heap buffer. The attacker then writes data into the buffer, overflowing into adjacent kernel heap objects and building a memory corruption primitive that can be chained to overwrite function pointers or other sensitive kernel structures for privilege escalation to root. No public proof-of-concept has been identified at time of analysis, making this scenario theoretical rather than immediately actionable.