Security readout for executives and security teams
Plain-English summary
A Linux AMD power-management driver can free the same memory twice if Smart PC setup fails and the amd-pmf driver is later unloaded. The supplied CVSS score is 7.8, reflecting potentially serious confidentiality, integrity, and availability impact, but exploitation requires local low-privileged access.
Executive priority
Treat as a high-priority local privilege risk on affected AMD Linux endpoints, especially shared workstations and systems granting untrusted users local access. It is less urgent for systems without AMD PMF exposure. There is no supplied evidence of active exploitation, so prioritize targeted inventory and normal expedited patching rather than emergency internet-edge response.
Technical view
The amd-pmf driver leaves dev->buf referencing freed memory after a Smart PC initialization failure. amd_pmf_remove() can free it again during driver removal, causing a double free. The cited kernel changes replace relevant allocations with device-managed allocations so cleanup occurs safely across failure paths.
Likely exposure
Exposure is limited to Linux systems using the AMD PMF driver and affected code. The bundle lists Linux 6.14, 6.15.4, and 6.16 as affected, but its version data is incomplete or ambiguous; confirm status against distribution and kernel-vendor guidance.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The failure path also requires unsuccessful Smart PC setup followed by amd-pmf removal. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The vulnerable sequence is a failed Smart PC setup, premature dev->buf release without nulling, and a second release in amd_pmf_remove(). The supplied record names no CWE and provides limited affected-version boundaries. Validate backports by commit content rather than release number alone; do not interpret the listed hashes as ordinary semantic versions.
Mitigation direction
- Apply a vendor kernel update containing the cited device-managed allocation fixes.
- Confirm remediation guidance with your Linux distribution or kernel vendor.
- Prioritize AMD systems that load amd-pmf or have experienced Smart PC setup failures.
- Restrict unnecessary local access until affected systems are updated.
Validation and detection
- Inventory kernel releases on AMD systems and compare them with vendor advisories.
- Determine whether the amd-pmf driver is present and loaded.
- Verify the running kernel contains either cited corrective commit or its vendor backport.
- Review kernel logs for AMD PMF setup failures or driver removal events.
- After updating, confirm the remediated kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38421 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796dCVE reference, Linux
- https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.