Memory Corruption Vulnerability in AMD Microcode Handling for Linux Kernel

CVE-2025-21991

Summary

A vulnerability has been identified in the AMD microcode handling within the Linux kernel, specifically occurring during the loading process across NUMA nodes with no CPUs. The method load_microcode_amd() incorrectly accesses CPU data by assuming the presence of a first CPU, which can lead to out-of-bounds memory access when a NUMA node has no CPUs. This issue, although lacking direct security implications, poses a significant risk to system stability and reliability when flashing microcode updates, potentially resulting in memory corruption. The fix involves refining the iteration process to consider only NUMA nodes with CPUs, thereby preventing this out-of-bounds access.

References