CVE-2025-21780: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-21780 Overview

CVE-2025-21780 is a buffer overflow vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The flaw resides in the smu_sys_set_pp_table() function, which handles power play table (pptable) updates through sysfs. A local user with write access to the sysfs interface can supply a small pptable followed by a larger pptable, triggering a heap buffer overflow because the existing buffer is not resized to accommodate the new input.

Critical Impact
Local attackers with low privileges can trigger a kernel-space buffer overflow, leading to memory corruption, denial of service, or potential local privilege escalation on systems with AMD GPUs.

Affected Products

Linux kernel (multiple stable branches prior to the patched commits)
Linux kernel 6.14-rc1
Linux kernel 6.14-rc2

Discovery Timeline

2025-02-27 - CVE-2025-21780 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-21780

Vulnerability Analysis

The vulnerability affects the AMD GPU System Management Unit (SMU) subsystem in the Linux kernel. The smu_sys_set_pp_table() function accepts a user-supplied power play table via the sysfs interface. The function fails to correctly validate or resize the destination buffer when a subsequent write provides more data than the previous allocation held.

When a local user first writes a small pptable, the kernel allocates a buffer sized to that initial input. A follow-up write of a larger pptable then copies data beyond the allocated buffer boundary. This out-of-bounds write corrupts adjacent kernel heap memory. The weakness is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Root Cause

The root cause is missing length reconciliation between successive pptable writes. The driver reuses the previously allocated buffer without verifying that its size is sufficient for the new payload. No reallocation or bounds check is performed before the copy operation, allowing user-controlled data to overflow the kernel heap allocation.

Attack Vector

Exploitation requires local access to the target host and permission to write to the AMD GPU sysfs pptable node. The attacker performs two sequential writes: an initial small pptable to set the buffer size, followed by a larger pptable that exceeds the allocation. The resulting kernel heap corruption can lead to denial of service through kernel panic or, with additional shaping of adjacent heap objects, memory corruption suitable for privilege escalation. No user interaction is required beyond the attacker's own writes.

See the upstream commits linked in the Patch Information section for the
technical fix. No verified public proof-of-concept is available at this time.

Detection Methods for CVE-2025-21780

Indicators of Compromise

Unexpected kernel oops, panic, or BUG: messages referencing smu_sys_set_pp_table or amdgpu SMU code paths in dmesg and /var/log/kern.log.
KASAN reports of out-of-bounds writes in the amdgpu driver on kernels compiled with memory sanitizers.
Non-root user processes writing repeatedly to /sys/class/drm/card*/device/pp_table with varying payload sizes.

Detection Strategies

Monitor process telemetry for non-privileged writes to AMD GPU sysfs pptable endpoints, which are unusual outside of administrative tooling.
Alert on kernel crashes or GPU driver faults on hosts running vulnerable kernel versions.
Correlate local user activity with GPU subsystem errors to identify probing behavior.

Monitoring Recommendations

Ingest kernel logs into a centralized logging or SIEM platform and alert on amdgpu SMU faults.
Track sysfs write activity on GPU device nodes using audit rules on /sys/class/drm/.
Baseline expected pptable modification patterns and flag deviations from administrative workflows.

How to Mitigate CVE-2025-21780

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fix commits referenced by kernel.org.
Apply distribution vendor updates, including the Debian LTS Announcement and the Siemens Security Advisory for affected industrial systems.
Restrict local user access on multi-user hosts with AMD GPUs until patches are deployed.

Patch Information

The fix has been merged upstream and backported across multiple stable branches. Reference the following commits: 1abb2648, 231075c5, 2498d2db, 3484ea33, and e43a8b9c. The patches ensure that the destination buffer is properly reallocated or size-checked before copying user-supplied pptable data.

Workarounds

Tighten permissions on AMD GPU sysfs pptable nodes so that only trusted administrative accounts can write to them.
Limit interactive local access on servers and workstations equipped with AMD GPUs.
Use mandatory access control policies such as SELinux or AppArmor to constrain which processes can modify GPU sysfs entries.

bash

# Restrict write access to AMD GPU pptable sysfs entries
for node in /sys/class/drm/card*/device/pp_table; do
    chmod 600 "$node"
    chown root:root "$node"
done

# Audit writes to GPU sysfs nodes
auditctl -w /sys/class/drm/ -p w -k amdgpu_sysfs_write