CVE-2026-81015 - Vulnerability Details

- platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

amd_pmc_probe() registers the LPS0 s2idle handler with
acpi_register_lps0_dev() and creates the driver's debugfs directory before
calling amd_stb_s2d_init(), which is the last step in probe that can fail.

When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot
be ioremapped on a long-running system, or the SMU rejects the S2D setup)
the error path only calls pci_dev_put() and returns. This leaves
amd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks
the debugfs directory, while the devm-managed resources backing the handler
are torn down.

Reloading the module then walks the corrupted list in
acpi_register_lps0_dev() and hits:

list_add corruption. next->prev should be prev, but was NULL.
kernel BUG at lib/list_debug.c:29!
acpi_register_lps0_dev+0x44/0x80
amd_pmc_probe+0x224/0x380 [amd_pmc]
platform_probe+0x67/0x90

Even without a reload, the stale registration means the next s2idle
transition calls into torn-down driver state.

Unwind the debugfs directory and the LPS0 registration on the
amd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is safe to call
unconditionally here: it is guarded on the same conditions as
acpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already
relies on.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a flaw in the AMD Performance Monitoring Controller driver within the Linux kernel (CWE-459). When the driver’s STB S2D telemetry initialization fails – for example, because the S2D telemetry region cannot be ioremapped or the SMU rejects the setup – the probe routine returns early but leaves a stale LPS0 s2idle handler registered and a debugfs directory unremoved. The leftover registration corrupts the global LPS0 list, causing the kernel to hit a BUG during a subsequent reload or normal s2idle transition, which results in a kernel crash.

Affected Systems

All Linux kernel builds that contain the built‑in amd_pmc driver are potentially affected, regardless of distribution. The CNA data lists only Linux, meaning the fix is at risk. Any system that loads the amd_pmc module and encounters the kernel is at risk.

Risk and Exploitability

The CVSS score of 7.8 reflects a high local denial‑of‑service impact. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local actor with the ability to load or reload the AMD PMC module before the initialization succeeds; they could trigger the failing path to corrupt internal structures and crash the system. It is inferred that exploitation requires kernel to reach the fault path.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`49de59f69a76f538bfa5d0638a8c98d052546567`	affected	< d201c09c2428a4a8fd3bdcb032ae99f1e016458c
`83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8`	affected	< bc9aa5fe21c3966c80647ed6574b94b863f23c62
`83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8`	affected	< 30e5f4d0cd0be655c800f10ae3e530391aa6c1b5
`83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8`	affected	< 76f650a76d6a36a4bee79d94db90a0e935a95477

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8,bc9aa5fe21c3966c80647ed6574b94b863f23c62)`	affected	code_commit	—
`[83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8,30e5f4d0cd0be655c800f10ae3e530391aa6c1b5)`	affected	code_commit	—
`[83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8,76f650a76d6a36a4bee79d94db90a0e935a95477)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	generic	—
`[0,6.14)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that contains the AMD PMC driver bug fixmc module and avoid reloading it until the security fix is applied.
If the LPSD telemetry feature is unnecessary, disable them via kernel configuration or module parameters to reduce the attack surface.
Consider rebooting the system after unloading the module to ensure all stale registrations are cleared.

Generated by OpenCVE AI on September 21, 2026 at 01:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/30e5f4d0cd0be655c800f10ae3e530391aa6c1b5
https://git.kernel.org/stable/c/76f650a76d6a36a4bee79d94db90a0e935a95477
https://git.kernel.org/stable/c/bc9aa5fe21c3966c80647ed6574b94b863f23c62
https://git.kernel.org/stable/c/d201c09c2428a4a8fd3bdcb032ae99f1e016458c
https://nvd.nist.gov/vuln/detail/CVE-2026-81015
https://www.cve.org/CVERecord?id=CVE-2026-81015

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/d201c09c2428a4a8fd3bdcb032ae99f1e016458c

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-459
References		https://nvd.nist.gov/vuln/detail/CVE-2026-81015 https://www.cve.org/CVERecord?id=CVE-2026-81015
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd_pmc_probe() registers the LPS0 s2idle handler with acpi_register_lps0_dev() and creates the driver's debugfs directory before calling amd_stb_s2d_init(), which is the last step in probe that can fail. When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot be ioremapped on a long-running system, or the SMU rejects the S2D setup) the error path only calls pci_dev_put() and returns. This leaves amd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks the debugfs directory, while the devm-managed resources backing the handler are torn down. Reloading the module then walks the corrupted list in acpi_register_lps0_dev() and hits: list_add corruption. next->prev should be prev, but was NULL. kernel BUG at lib/list_debug.c:29! acpi_register_lps0_dev+0x44/0x80 amd_pmc_probe+0x224/0x380 [amd_pmc] platform_probe+0x67/0x90 Even without a reload, the stale registration means the next s2idle transition calls into torn-down driver state. Unwind the debugfs directory and the LPS0 registration on the amd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is safe to call unconditionally here: it is guarded on the same conditions as acpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already relies on.
Title		platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/30e5f4d0cd0be655c800f10ae3e530391aa6c1b5 https://git.kernel.org/stable/c/76f650a76d6a36a4bee79d94db90a0e935a95477 https://git.kernel.org/stable/c/bc9aa5fe21c3966c80647ed6574b94b863f23c62

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:04.063Z

Updated: 2026-10-03T10:56:23.541Z

Reserved: 2026-08-26T14:34:25.813Z

Link: CVE-2026-81015

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:10.437

Modified: 2026-10-03T11:17:41.570

Link: CVE-2026-81015

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:04Z

Links: CVE-2026-81015 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:45:07Z

Weaknesses

CWE-459
Incomplete Cleanup

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object