CVE-2025-38421 (GCVE-0-2025-38421)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:16 – Updated: 2026-08-05 12:01
VLAI
Title
platform/x86/amd: pmf: Use device managed allocations
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmf: Use device managed allocations If setting up smart PC fails for any reason then this can lead to a double free when unloading amd-pmf. This is because dev->buf was freed but never set to NULL and is again freed in amd_pmf_remove(). To avoid subtle allocation bugs in failures leading to a double free change all allocations into device managed allocations.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5b1122fc4995f308b21d7cfc64ef9880ac834d20 , < 0d10b532f861253c283863522d59d099fcb0796d (git)
Affected: 5b1122fc4995f308b21d7cfc64ef9880ac834d20 , < d9db3a941270d92bbd1a6a6b54a10324484f2f2d (git)
Affected: e70b4b8f93d7fcf8ee063a1d1f18782c4da3d335 (git)
Affected: 3ed60e51ffdbfef14169bd967e21a6ba5e5ff42b (git)
Affected: 6.12.23 , < 6.13 (semver)
Affected: 6.13.11 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/amd/pmf/core.c",
            "drivers/platform/x86/amd/pmf/tee-if.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d10b532f861253c283863522d59d099fcb0796d",
              "status": "affected",
              "version": "5b1122fc4995f308b21d7cfc64ef9880ac834d20",
              "versionType": "git"
            },
            {
              "lessThan": "d9db3a941270d92bbd1a6a6b54a10324484f2f2d",
              "status": "affected",
              "version": "5b1122fc4995f308b21d7cfc64ef9880ac834d20",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e70b4b8f93d7fcf8ee063a1d1f18782c4da3d335",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ed60e51ffdbfef14169bd967e21a6ba5e5ff42b",
              "versionType": "git"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/amd/pmf/core.c",
            "drivers/platform/x86/amd/pmf/tee-if.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: pmf: Use device managed allocations\n\nIf setting up smart PC fails for any reason then this can lead to\na double free when unloading amd-pmf.  This is because dev-\u003ebuf was\nfreed but never set to NULL and is again freed in amd_pmf_remove().\n\nTo avoid subtle allocation bugs in failures leading to a double free\nchange all allocations into device managed allocations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The amd-pmf platform driver is reachable only from the local machine \u2014 via driver unbind/module unload, the suspend/resume PM path, or the debugfs `update_policy` handler. There is no network or adjacent-network exposure.\nAC:L - On an affected system (AMD laptop whose BIOS advertises Smart PC while the PMF TA/policy is unavailable) `amd_pmf_init_smart_pc()` fails deterministically at every boot, leaving `dev-\u003ebuf`, `dev-\u003epolicy_buf` and `dev-\u003eprev_data` dangling, so the attacker simply triggers unbind or a suspend/resume cycle to hit the double free/UAF with 100% reliability.\nPR:L - The dangling `pdev-\u003ebuf` is dereferenced from `amd_pmf_resume_handler()`/`amd_pmf_restore_handler()` and from the re-armed `pb_work` handler, and an unprivileged local user in an active session can initiate suspend/resume through logind; heap grooming to control the reused slab object also needs only unprivileged allocations.\nUI:N - The attacker performs the triggering action themselves (driver unbind/module unload or a suspend/resume cycle); no separate victim needs to be induced into any action.\nS:U - The corrupted memory and the resulting privilege escalation are entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `dev-\u003ebuf`/`dev-\u003eprev_data` pointers are read after free (`memcpy(\u0026dev-\u003em_table, dev-\u003ebuf, dev-\u003emtable_size)` in `amd_pmf_get_smu_info()`), leaking reallocated kernel slab contents, and the double free gives the attacker a slab object shared with another subsystem, which is a general kernel-memory read primitive.\nI:H - The double free of `dev-\u003ebuf` (and of `policy_buf`/`prev_data`) lets the same slab object be handed to two owners, and the UAF write paths (`memset(dev-\u003ebuf, 0, dev-\u003emtable_size)`, `dev-\u003eprev_data-\u003espl = val`, plus SMU DMA into the freed page programmed by `amd_pmf_set_dram_addr()`) provide a controlled write into live kernel objects, which is exploitable for control-flow hijack.\nA:H - A double free triggers immediate slab freelist corruption \u2014 a BUG/panic under freelist hardening or CONFIG_SLUB_DEBUG, and unbounded heap corruption leading to a crash otherwise; the UAF accesses from the PM resume path can be repeated to reliably crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:44.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d"
        }
      ],
      "title": "platform/x86/amd: pmf: Use device managed allocations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38421",
    "datePublished": "2025-07-25T14:16:42.409Z",
    "dateReserved": "2025-04-16T04:51:24.014Z",
    "dateUpdated": "2026-08-05T12:01:44.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38421",
      "date": "2026-10-06",
      "epss": "0.00158",
      "percentile": "0.04343"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/platform/x86/amd/pmf/core.c",
                  "drivers/platform/x86/amd/pmf/tee-if.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0d10b532f861253c283863522d59d099fcb0796d",
                    "status": "affected",
                    "version": "5b1122fc4995f308b21d7cfc64ef9880ac834d20",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9db3a941270d92bbd1a6a6b54a10324484f2f2d",
                    "status": "affected",
                    "version": "5b1122fc4995f308b21d7cfc64ef9880ac834d20",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e70b4b8f93d7fcf8ee063a1d1f18782c4da3d335",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "3ed60e51ffdbfef14169bd967e21a6ba5e5ff42b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "affected",
                    "version": "6.12.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "affected",
                    "version": "6.13.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/platform/x86/amd/pmf/core.c",
                  "drivers/platform/x86/amd/pmf/tee-if.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "50F52A53-697C-4085-B8FE-105DE882578F",
                    "versionEndExcluding": "6.13",
                    "versionStartIncluding": "6.12.23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "124AE182-7E9F-4410-9E08-5976ED49C6A4",
                    "versionEndExcluding": "6.14",
                    "versionStartIncluding": "6.13.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A43298F2-A0DE-4797-B4E4-14DE5F4D5EED",
                    "versionEndExcluding": "6.15.4",
                    "versionStartIncluding": "6.14.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*",
                    "matchCriteriaId": "7DE421BA-0600-4401-A175-73CAB6A6FB4E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "AD948719-8628-4421-A340-1066314BBD4A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: pmf: Use device managed allocations\n\nIf setting up smart PC fails for any reason then this can lead to\na double free when unloading amd-pmf.  This is because dev-\u003ebuf was\nfreed but never set to NULL and is again freed in amd_pmf_remove().\n\nTo avoid subtle allocation bugs in failures leading to a double free\nchange all allocations into device managed allocations."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: platform/x86/amd: pmf: Usar asignaciones administradas por dispositivo. Si la configuraci\u00f3n de Smart PC falla por cualquier motivo, esto puede provocar una doble liberaci\u00f3n al descargar amd-pmf. Esto se debe a que dev-\u0026gt;buf se liber\u00f3, pero nunca se configur\u00f3 como NULL y se libera de nuevo en amd_pmf_remove(). Para evitar errores sutiles de asignaci\u00f3n en fallos que provoquen una doble liberaci\u00f3n, cambie todas las asignaciones a asignaciones administradas por dispositivo."
          }
        ],
        "id": "CVE-2025-38421",
        "lastModified": "2026-07-30T06:23:13.267",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-25T15:15:26.927",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:29:50+00:00",
      "cve": "CVE-2025-38421",
      "id": "CVE-2025-38421",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: platform/x86/amd: pmf: Use device managed allocations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38421.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-03T00:14:43Z",
      "cve": "CVE-2025-38421",
      "id": "CVE-2025-38421",
      "initial_release_date": "2025-07-29T23:23:48Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "524",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38421",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38421.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.