CVE-2025-38421: platform/x86/amd: pmf: Use device managed allocations
In the Linux kernel, the following vulnerability has been resolved:
platform/x86/amd: pmf: Use device managed allocations
If setting up smart PC fails for any reason then this can lead to a double free when unloading amd-pmf. This is because dev->buf was freed but never set to NULL and is again freed in amdpmfremove().
To avoid subtle allocation bugs in failures leading to a double free change all allocations into device managed allocations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1018.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38421?
CVE-2025-38421 is classified as a medium severity vulnerability.
How do I fix CVE-2025-38421?
To fix CVE-2025-38421, update the Linux kernel to the latest version where the vulnerability is resolved.
What are the consequences of CVE-2025-38421?
The consequence of CVE-2025-38421 is a potential double free error during the unloading of amd-pmf, which may lead to system instability.
Which systems are affected by CVE-2025-38421?
CVE-2025-38421 affects devices utilizing specific platforms in the Linux kernel related to AMD power management.
What components are involved in CVE-2025-38421?
CVE-2025-38421 involves device managed allocations in the AMD power management framework within the Linux kernel.