Skip to main content

Linux Kernel CVE-2026-53121

| EUVDEUVD-2026-38989 MEDIUM
Memory Leak (CWE-401)
2026-06-24 Linux GHSA-h8rj-w8q4-6g6r
Linux Amd Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects that EPP initialization failure depends on AMD firmware behavior, not reliably user-controllable; PR:L per local driver context; no C or I impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:10 vuln.today
CVSS changed
Jul 23, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()

On failure to set the epp, the function amd_pstate_epp_cpu_init() returns with an error code without freeing the cpudata object that was allocated at the beginning of the function.

Ensure that the cpudata object is freed before returning from the function.

This memory leak was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts (https://github.com/masoncl/review-prompts/tree/main/kernel).

AnalysisAI

Memory leak in the Linux kernel's amd-pstate driver allows local availability impact on systems running AMD CPUs when EPP (Energy Performance Preference) initialization fails. The amd_pstate_epp_cpu_init() function allocates a cpudata object at entry but lacks a corresponding free on the error path triggered when setting the EPP value fails, causing kernel heap memory to leak on each failed CPU initialization event. No public exploit exists and EPSS sits at 0.15% (5th percentile), reflecting negligible adversarial interest; risk is primarily operational - repeated CPU hotplug cycles on affected hardware can progressively exhaust kernel memory.

Technical ContextAI

The vulnerability resides in the Linux kernel's amd-pstate CPU frequency scaling driver, specifically in the amd_pstate_epp_cpu_init() function responsible for initializing Energy Performance Preference support on AMD processors. CPE data identifies the affected product as cpe:2.3:a:linux:linux. CWE-401 (Missing Release of Memory after Effective Lifetime) is the root cause class: when the kernel allocates a cpudata structure at function entry and subsequently fails the EPP hardware-set operation, the error return branch skips the corresponding kfree(), permanently leaking the allocation into the kernel heap. This class of bug is common in kernel driver init/teardown paths and typically surfaces through CPU hotplug stress testing or systems with inconsistent ACPI/firmware EPP register support. The amd-pstate driver is the default P-state driver on most modern AMD CPU systems running Linux 5.17 and later.

RemediationAI

Apply the vendor-released kernel patches targeting Linux 6.18.33, 7.0.10, or 7.1 depending on the running branch. The upstream fix commits are available at https://git.kernel.org/stable/c/539aabbab190825c77eb455ec35652cb3720625f, https://git.kernel.org/stable/c/7f9aa2359742eaa6ea65ec0d20dafdfd0add9b8b, and https://git.kernel.org/stable/c/beda3b363546a423e4e29a7395e04c0ac4ff677e. Ubuntu users should apply the updates referenced in USN-8566-1 and USN-8568-1. As a compensating control where immediate patching is not feasible, administrators can set the kernel boot parameter amd_pstate=passive or amd_pstate=disable to prevent the EPP code path from executing entirely; this trades potential power efficiency for elimination of the leak, with the trade-off that AMD hardware will fall back to the acpi-cpufreq governor. Monitoring kernel memory (slab usage via /proc/slabinfo) for growth correlated with CPU hotplug events can help detect impact on affected unpatched systems.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53121 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy