Executive brief
A race condition vulnerability exists in the AMD graphics interface that could allow a high-privileged local user to compromise system integrity. By repeatedly loading hardware registers, an attacker could bypass security checks during the brief window between when a value is verified and when it is actually used. This could lead to unauthorized modifications of system state or data.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CWE-367) exists within the AMD graphics interface. The flaw occurs when the system validates a register value but an attacker manages to modify that value before it is actually utilized by the hardware or driver. This race condition is triggered by repeatedly loading registers, which can lead to a loss of integrity. Exploitation requires local access with high privileges (PR:H) and faces high architectural complexity (AC:H), limiting the practical impact. AMD has addressed this in security bulletins AMD-SB-4017 and AMD-SB-6027.
Affected products
- AMD Graphics Interface
Timeline
- 2026-05-15: disclosed: Initial NVD publication date