CVE-2025-38421CWE-415

CVE-2025-38421

High · published July 25, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd: pmf: Use device managed allocations

If setting up smart PC fails for any reason then this can lead to

a double free when unloading amd-pmf. This is because dev->buf was

freed but never set to NULL and is again freed in amd_pmf_remove().

To avoid subtle allocation bugs in failures leading to a double free

change all allocations into device managed allocations.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00185 · 7.6th percentile
Weakness
CWE-415 · Double Free
Published
2025-07-25T19:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernel≥ 6.12.23, < 6.136.13
linux/linux_kernel≥ 6.13.11, < 6.146.14
linux/linux_kernel≥ 6.14.1, < 6.15.46.15.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d6a38e1a82d2f9abd0bae84a354654bccb8389f6 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 25 JUL 14:16Z
    platform/x86/amd: pmf: Use device managed allocations
    cvelistv5