PT-2025-14488 · Linux+11 · Linux Kernel+11
Published
2025-03-10
·
Updated
2026-04-20
·
CVE-2025-21991
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to an out-of-bounds error in the Linux kernel on systems with CPU-less NUMA nodes. This occurs when the load microcode amd function iterates over all NUMA nodes and attempts to access per-CPU data for the first CPU of each mask, even if the node has no CPUs. This can potentially corrupt memory while flashing a microcode update. The error is triggered when booting with CONFIG UBSAN BOUNDS=y on an AMD machine that flashes a microcode update, resulting in an array-index-out-of-bounds error.
Recommendations
To resolve the issue, change the loop in the load microcode amd function to only iterate over NUMA nodes that have CPUs before determining whether the first CPU on the respective node needs a microcode update.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Improper Validation of Array Index
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu