UBUNTU-CVE-2025-38421: Double Free

Q: Which Ubuntu systems are in scope?

The affected software list includes the ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, and ubuntu/linux-gkeop kernel packages. The flaw is in the AMD PMF platform/x86 component.

Q: What access does an attacker need?

The severity vector indicates local attack access and low privileges are required. No user interaction is required.

Q: What condition triggers the double free?

The issue can occur when Smart PC setup fails and the amd-pmf component is later unloaded. In that failure path, a buffer may already have been freed without being cleared, then freed again during amd_pmf_remove().

Published Jul 25, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmf: Use device managed allocations If setting up smart PC fails for any reason then this can lead to a double free when unloading amd-pmf. This is because dev->buf was freed but never set to NULL and is again freed in amdpmfremove(). To avoid subtle allocation bugs in failures leading to a double free change all allocations into device managed allocations.

Affected Software

131 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1014.14~24.04.1

6.14.0-1014.14~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14<6.14.0-1007.7

6.14.0-1007.7

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1018.19~24.04.1

6.14.0-1018.19~24.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1014.14

6.14.0-1014.14

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-34.34.1~24.04.1

6.14.0-34.34.1~24.04.1

ubuntu/linux-vmware*

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14<6.14.0-1014.14~24.04.1

6.14.0-1014.14~24.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1007.7
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1018.19~24.04.1
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-34.34.1~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14~24.04.1
Configuration
Change all amd-pmf allocations to device-managed allocations to prevent double-free failures when smart PC setup fails.
Linux kernel platform/x86/amd pmf allocation management = device-managed allocations

Event History

Jul 25, 2025

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu systems are in scope?

The affected software list includes the ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, and ubuntu/linux-gkeop kernel packages. The flaw is in the AMD PMF platform/x86 component.

What access does an attacker need?

The severity vector indicates local attack access and low privileges are required. No user interaction is required.

What condition triggers the double free?

The issue can occur when Smart PC setup fails and the amd-pmf component is later unloaded. In that failure path, a buffer may already have been freed without being cleared, then freed again during amd_pmf_remove().

UBUNTU-CVE-2025-38421: Double Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu systems are in scope?

What access does an attacker need?

What condition triggers the double free?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu systems are in scope?

What access does an attacker need?

What condition triggers the double free?