CVE-2025-38421

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38421
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmf: Use device managed allocations If setting up smart PC fails for any reason then this can lead to a double free when unloading amd-pmf. This is because dev->buf was freed but never set to NULL and is again freed in amd_pmf_remove(). To avoid subtle allocation bugs in failures leading to a double free change all allocations into device managed allocations.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d Patch
https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
History

19 Nov 2025, 18:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: platform/x86/amd: pmf: Usar asignaciones administradas por dispositivo. Si la configuración de Smart PC falla por cualquier motivo, esto puede provocar una doble liberación al descargar amd-pmf. Esto se debe a que dev->buf se liberó, pero nunca se configuró como NULL y se libera de nuevo en amd_pmf_remove(). Para evitar errores sutiles de asignación en fallos que provoquen una doble liberación, cambie todas las asignaciones a asignaciones administradas por dispositivo.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
CWE CWE-415
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d - () https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d - Patch
References () https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d - () https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d - Patch

25 Jul 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 15:15

Updated : 2025-11-19 18:59

NVD link : CVE-2025-38421

Mitre link : CVE-2025-38421

CVE.ORG link : CVE-2025-38421

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free