Description
In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

amd_pmc_probe() registers the LPS0 s2idle handler with
acpi_register_lps0_dev() and creates the driver's debugfs directory before
calling amd_stb_s2d_init(), which is the last step in probe that can fail.

When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot
be ioremapped on a long-running system, or the SMU rejects the S2D setup)
the error path only calls pci_dev_put() and returns. This leaves
amd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks
the debugfs directory, while the devm-managed resources backing the handler
are torn down.

Reloading the module then walks the corrupted list in
acpi_register_lps0_dev() and hits:

list_add corruption. next->prev should be prev, but was NULL.
kernel BUG at lib/list_debug.c:29!
acpi_register_lps0_dev+0x44/0x80
amd_pmc_probe+0x224/0x380 [amd_pmc]
platform_probe+0x67/0x90

Even without a reload, the stale registration means the next s2idle
transition calls into torn-down driver state.

Unwind the debugfs directory and the LPS0 registration on the
amd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is safe to call
unconditionally here: it is guarded on the same conditions as
acpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already
relies on.
Published: 2026-09-11
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Kernel crash leading to denial of service
Action: Apply patch
AI Analysis

Impact

The vulnerability is a flaw in the AMD Performance Monitoring Controller driver within the Linux kernel. When the driver’s STB S2D telemetry initialization fails – for example, because the S2D telemetry region cannot be ioremapped or the SMU rejects the setup – the probe routine returns early but leaves a stale LPS0 s2idle handler registered and a debugfs directory unremoved. The leftover registration corrupts the global LPS0 list, causing the kernel to hit a BUG during a subsequent reload or normal s2idle transition, which results in a kernel crash.

Affected Systems

All Linux kernel builds that contain the built‑in amd_pmc driver are potentially affected, regardless of distribution. The CNA data lists only Linux to the fix is at risk. Any system that loads the amd_pmc module and encounters a failing STB init will be impacted until the kernel is updated.

Risk and Exploitability

The CVSS score of 4.4 reflects a moderate local denial‑of‑service impact. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s The likely attack vector is a local actor with the ability to load or reload the AMD PMC module before the initialization succeeds; they could trigger the failing path to corrupt internal structures and crash the system. It is inferred that exploitation requires kernel loading privileges, as the module must be loaded to reach the fault path.

Generated by OpenCVE AI on September 13, 2026 at 03:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the AMD PMC driver bug fix.
  • Until a patched kernel is available, unload the amd_pmc module and avoid reloading it until the security fix is applied.
  • If the LPS0 s2idle functionality or the S2D telemetry feature is unnecessary, disable them via kernel configuration or module parameters to reduce the attack surface.
  • Consider rebooting the system after unloading the module to ensure all stale registrations are cleared.

Generated by OpenCVE AI on September 13, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-459
References
Metrics threat_severity

None

cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd_pmc_probe() registers the LPS0 s2idle handler with acpi_register_lps0_dev() and creates the driver's debugfs directory before calling amd_stb_s2d_init(), which is the last step in probe that can fail. When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot be ioremapped on a long-running system, or the SMU rejects the S2D setup) the error path only calls pci_dev_put() and returns. This leaves amd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks the debugfs directory, while the devm-managed resources backing the handler are torn down. Reloading the module then walks the corrupted list in acpi_register_lps0_dev() and hits: list_add corruption. next->prev should be prev, but was NULL. kernel BUG at lib/list_debug.c:29! acpi_register_lps0_dev+0x44/0x80 amd_pmc_probe+0x224/0x380 [amd_pmc] platform_probe+0x67/0x90 Even without a reload, the stale registration means the next s2idle transition calls into torn-down driver state. Unwind the debugfs directory and the LPS0 registration on the amd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is safe to call unconditionally here: it is guarded on the same conditions as acpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already relies on.
Title platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:29:17.255Z

Reserved: 2026-08-26T14:34:25.813Z

Link: CVE-2026-81015

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:10.437

Modified: 2026-09-13T07:17:07.983

Link: CVE-2026-81015

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:04Z

Links: CVE-2026-81015 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T03:30:17Z

Weaknesses