LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table().

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user can trigger a memory overflow in the Linux AMDGPU driver by submitting differently sized power-management tables through sysfs. Successful exploitation could crash the system or compromise sensitive data and system integrity. The issue is rated high severity but is not remotely exploitable under the supplied CVSS assessment.

Executive priority

Prioritize patching shared GPU servers, workstations with untrusted local users, and affected appliances. The local-access requirement reduces urgency compared with a remote flaw, but possible kernel-level confidentiality, integrity, and availability impact makes routine deferral inappropriate.

Technical view

CVE-2025-21780 is a CWE-120 buffer overflow in smu_sys_set_pp_table(). Supplying a small PowerPlay table through sysfs followed by a larger table can exceed the allocated buffer. The supplied CVSS 3.1 score is 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is limited to Linux systems using affected kernel code in the AMDGPU driver where a local low-privileged user can reach the relevant sysfs interface. The supplied affected-version data is ambiguous, so distribution kernel package status and fix backports should determine exposure rather than version strings alone.

Exploitation context

The supplied sources do not establish active exploitation, and the CVE is not identified as KEV. Exploitation requires local access and interaction with the AMDGPU sysfs power-table path. Treat internet exposure as indirect: an attacker would first need local execution or an account on a vulnerable system.

Researcher notes

Multiple Linux stable commits are supplied, indicating fixes across maintained branches. The affected-version list contains unclear entries and repeated commit identifiers, preventing reliable boundary reconstruction from this bundle. Validate distro backports directly. No supplied evidence demonstrates public exploitation, and testing should avoid production systems because kernel memory corruption may cause instability.

Mitigation direction

  • Install the fixed kernel package provided by the operating-system or appliance vendor.
  • Reboot into the updated kernel after installation.
  • Restrict untrusted local access while affected systems await updates.
  • Consult vendor advisories for product-specific fixed releases and backports.

Validation and detection

  • Inventory Linux systems using AMD GPUs and the AMDGPU kernel driver.
  • Record running kernel versions and compare them with vendor advisory status.
  • Confirm installed kernels contain the applicable upstream stable fix or vendor backport.
  • After rebooting, verify the updated kernel is running.
  • Review local access and permissions around the relevant AMDGPU sysfs interfaces.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-120: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-21780 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
3ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-21780Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux137d63abbf6a0859e79b662e81d21170ecb75e59, 137d63abbf6a0859e79b662e81d21170ecb75e59, 137d63abbf6a0859e79b662e81d21170ecb75e59, 137d63abbf6a0859e79b662e81d21170ecb75e59, 137d63abbf6a0859e79b662e81d21170ecb75e59unaffected
LinuxLinux5.2, 0, 6.1.129, 6.6.79, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

CWE-120

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-120 · source CWE mapping

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs