Linux Kernel AMD GPU Driver Incomplete Address Validation

CVE-2026-53375 is a memory corruption vulnerability in the Linux kernel's AMD GPU (amdgpu) VCE driver that occurs when address patching operations receive incomplete data. Specifically, when only one component (either the lower or higher address bits) is valid during a patch operation, the driver writes a malformed address to firmware, potentially causing memory corruption or undefined behavior. This affects Linux systems with AMD graphics hardware running vulnerable kernel versions. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the high CVSS score of 8.8 indicates significant risk potential for systems where GPU drivers operate with elevated privileges.

Casky.ai's Claude-powered analysis engine would detect attack patterns related to this vulnerability by monitoring for anomalous memory writes and firmware interaction sequences associated with GPU driver operations. Practitioners using Casky would observe findings mapped to techniques like T1542 (Firmware Corruption) and T1203 (Exploitation for Privilege Escalation), as successful exploitation could allow attackers to corrupt GPU firmware or achieve code execution with kernel-level privileges. The platform's extended reasoning capability would identify suspicious partial address patches—sequences where lo/hi address components are inconsistently validated—as indicators of exploitation attempts, enabling security teams to correlate kernel audit logs, GPU driver behavior, and system stability events to catch this vulnerability before it can be weaponized in their environment.