Executive brief
The AMD Platform Management Controller (PMC) driver in the Linux kernel fails to properly clean up system resources when power management telemetry initialization encounters an error. This leaves debug interfaces and kernel data structures in a corrupted state, which can cause system crashes during module reload or the next low-power sleep transition. Systems running affected kernel versions with AMD processors may experience unexpected crashes or instability.
Technical details
The vulnerability is a resource leak in the amd_pmc_probe() function in drivers/platform/x86/amd/pmc/pmc.c. The driver registers an LPS0 s2idle handler and creates a debugfs directory before calling amd_stb_s2d_init(), but when the STB (Smart Trace Buffer) initialization fails, the error path does not unwind these registrations. This leaves the amd_pmc_s2idle_dev_ops pointer on a global kernel list and leaks the debugfs directory, while devm-managed resources backing the handler are freed. Subsequent module reload or s2idle transition attempts trigger a kernel BUG via list corruption ("list_add corruption. next->prev should be prev, but was NULL") or call into freed memory. The fix adds proper unwinding of debugfs and LPS0 registration on the amd_stb_s2d_init() error path. No network attack vector is required; the condition is triggered only when STB initialization fails during driver probe, such as when the S2D telemetry region cannot be mapped.
Affected products
- Linux Linux kernel versions containing commit 83ad6974dd3b onwards (approximately kernel 6.9+) until patched
Timeline
- 2026-09-11: disclosed: CVE-2026-81015 published on NVD
- 2026-07-27: patched: Fix committed upstream as commit 76f650a76d6a36a4bee79d94db90a0e935a95477