CVE-2026-53121: Linux Kernel Memory Leak Vulnerability

CVE-2026-53121 Overview

CVE-2026-53121 is a memory leak vulnerability in the Linux kernel's amd-pstate CPU frequency scaling driver. The flaw resides in the amd_pstate_epp_cpu_init() function, which allocates a cpudata object at the start of execution. When the function fails to set the Energy Performance Preference (EPP), it returns an error code without freeing the allocated cpudata object, leaking kernel memory on each failure path.

The issue was discovered by Claude Opus 4.6 using Chris Mason's AI kernel review prompts. Fixes have been merged across multiple stable kernel branches.

Critical Impact
Repeated initialization failures of the amd-pstate EPP driver can progressively exhaust kernel memory, potentially leading to denial-of-service conditions on affected AMD platforms.

Affected Products

Linux kernel versions containing the amd-pstate EPP driver prior to the fix
Systems using AMD processors with the Energy Performance Preference (EPP) feature
Kernel branches addressed by commits 539aabb, 7f9aa23, and beda3b3

Discovery Timeline

2026-06-24 - CVE-2026-53121 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53121

Vulnerability Analysis

The amd-pstate driver implements CPU performance state management for AMD processors. During initialization, amd_pstate_epp_cpu_init() allocates a cpudata structure to hold per-CPU state information for the Energy Performance Preference subsystem.

The function then attempts to configure the EPP for the CPU. If this configuration step fails, the function exits via an error path and returns the failure code to the caller. The allocated cpudata object is not released along this error path, resulting in a kernel memory leak [CWE-401].

While a single leak is small, repeated EPP initialization failures across multiple CPUs or hot-plug cycles accumulate leaked allocations in kernel space. Over time, this can degrade system performance or contribute to memory exhaustion.

Root Cause

The root cause is a missing kfree() call on the cpudata object in the error-handling branch of amd_pstate_epp_cpu_init(). The allocation is performed unconditionally at function entry, but cleanup is absent when EPP setup fails. The fix ensures the cpudata object is freed before returning the error code.

Attack Vector

This is a local reliability issue rather than a remotely exploitable flaw. Triggering the leak requires conditions under which amd_pstate_epp_cpu_init() fails during CPU initialization or hot-plug operations. An attacker with the ability to repeatedly induce EPP initialization failures could amplify the leak, but no remote attack path exists. See the upstream commits for the precise fix:

Detection Methods for CVE-2026-53121

Indicators of Compromise

Growing kmalloc-* slab cache usage visible in /proc/slabinfo on AMD systems running the amd-pstate EPP driver
Kernel log entries showing repeated amd-pstate initialization failures
Unexplained gradual reduction in available kernel memory on long-running AMD hosts

Detection Strategies

Compare the running kernel version against the patched commits 539aabb, 7f9aa23, and beda3b3 to determine exposure
Monitor dmesg output for amd_pstate_epp_cpu_init error returns during boot and CPU hot-plug events
Use kmemleak on test or staging systems to confirm leaked allocations originating from the amd-pstate driver

Monitoring Recommendations

Track kernel slab memory growth over time using node-level telemetry agents
Alert on sustained increases in Slab or SUnreclaim values reported by /proc/meminfo
Audit kernel package versions across AMD fleet endpoints to ensure patched builds are deployed

How to Mitigate CVE-2026-53121

Immediate Actions Required

Identify all Linux systems running on AMD processors that load the amd-pstate driver in EPP mode
Apply the stable kernel updates containing commits 539aabb, 7f9aa23, or beda3b3 from your distribution vendor
Schedule reboots to load the patched kernel on affected hosts

Patch Information

The fix adds a kfree() call to release the cpudata object before returning from amd_pstate_epp_cpu_init() on the EPP failure path. The patch has been merged to upstream stable branches via the referenced commits. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

Boot with amd_pstate=disable on the kernel command line to fall back to acpi-cpufreq until patched kernels are deployed
Use intel_pstate=disable amd_pstate=passive to reduce the use of the EPP code path on affected systems where supported
Restrict local user access on multi-tenant AMD hosts to limit the ability to repeatedly trigger CPU initialization paths

bash

# Verify whether amd-pstate EPP mode is active
cat /sys/devices/system/cpu/amd_pstate/status

# Temporarily disable amd-pstate via GRUB until patched kernel is installed
# Edit /etc/default/grub and add amd_pstate=disable to GRUB_CMDLINE_LINUX
sudo sed -i 's/GRUB_CMDLINE_LINUX="/GRUB_CMDLINE_LINUX="amd_pstate=disable /' /etc/default/grub
sudo update-grub
sudo reboot