CVE-2026-81015 Overview
CVE-2026-81015 affects the AMD Platform Management Controller (PMC) driver in the Linux kernel. The amd_pmc_probe() function registers an LPS0 s2idle handler and creates a debugfs directory before calling amd_stb_s2d_init(). When amd_stb_s2d_init() fails, the error path only releases the PCI device reference. This leaves stale entries on the global lps0_s2idle_devops_head list and leaks the debugfs directory while the underlying devm-managed resources are torn down.
Critical Impact
A local, low-privileged trigger of the failure path corrupts kernel list state, causing a kernel BUG on module reload and use of torn-down driver state during subsequent s2idle transitions.
Affected Products
- Linux kernel platform/x86/amd/pmc driver on AMD systems using LPS0 s2idle
- Kernel branches prior to the fixes in commits 30e5f4d, 76f650a, and bc9aa5f
- AMD platforms exercising STB (Smart Trace Buffer) S2D telemetry initialization
Discovery Timeline
- 2026-09-11 - CVE-2026-81015 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-81015
Vulnerability Analysis
The defect is a resource cleanup ordering flaw in the AMD PMC driver's probe path. amd_pmc_probe() performs two registrations with global state, calling acpi_register_lps0_dev() and creating a debugfs directory, before invoking amd_stb_s2d_init(). That last call can fail when the S2D telemetry region cannot be ioremaped on a long-running system, or when the System Management Unit (SMU) rejects the S2D setup.
On failure, the error path calls only pci_dev_put() and returns. The amd_pmc_s2idle_dev_ops entry remains on the global lps0_s2idle_devops_head list, and the debugfs directory persists. However, the devm-managed memory backing the handler is released when probe returns an error. The result is a dangling list node pointing into freed memory.
Reloading the module then invokes acpi_register_lps0_dev() again, which walks the corrupted list and triggers list_add corruption. next->prev should be prev, but was NULL. at lib/list_debug.c:29, producing a kernel BUG. Even without a reload, the next s2idle suspend transition calls into torn-down driver state, extending the impact to use-after-free style behavior.
Root Cause
The probe function registers with global subsystems before all fallible initialization steps complete, and the error path fails to unwind those registrations. Cleanup asymmetry between amd_pmc_probe() and amd_pmc_remove() leaves list membership and debugfs artifacts in place after devm teardown.
Attack Vector
Exploitation requires local access and the ability to cause amd_stb_s2d_init() to fail, followed by a module reload or an s2idle suspend attempt. On systems where the STB region is intermittently unavailable, the failure can occur without deliberate action. Successful triggering yields kernel list corruption, a kernel panic on reload, and interaction with freed driver state during power transitions.
No synthetic exploit code is presented. See the upstream fix commits for the corrected unwind sequence: Kernel Git Commit 30e5f4d, Kernel Git Commit 76f650a, and Kernel Git Commit bc9aa5f.
Detection Methods for CVE-2026-81015
Indicators of Compromise
- Kernel log entries containing list_add corruption. next->prev should be prev, but was NULL. referencing acpi_register_lps0_dev+0x44/0x80 and amd_pmc_probe.
- Kernel BUG messages originating at lib/list_debug.c:29 following an amd_pmc module reload.
- Unexpected system crashes or hangs during s2idle suspend transitions on AMD hardware.
Detection Strategies
- Monitor dmesg and journald for amd_pmc probe failures, particularly messages tied to STB ioremap errors or SMU rejection of the S2D setup.
- Alert on kernel oops or BUG events in EDR telemetry that reference amd_pmc_probe or acpi_register_lps0_dev in the call stack.
- Track kernel package versions across the fleet and flag AMD hosts running vulnerable platform/x86/amd/pmc builds.
Monitoring Recommendations
- Forward kernel ring buffer logs from AMD endpoints to a centralized logging pipeline with parsing for list-debug and BUG signatures.
- Correlate suspend/resume failure events with subsequent module reload activity to catch triggering sequences.
- Baseline the presence of /sys/kernel/debug/amd_pmc and alert on unexpected persistence after driver unload.
How to Mitigate CVE-2026-81015
Immediate Actions Required
- Apply the upstream kernel fixes referenced by commits 30e5f4d, 76f650a, and bc9aa5f through your distribution's kernel update channel.
- Reboot affected AMD systems after patching to ensure the corrected amd_pmc driver is loaded.
- Restrict local shell and module management access on AMD platforms until patches are deployed.
Patch Information
The fix unwinds the debugfs directory and the LPS0 registration on the amd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is invoked in the failure branch, matching the cleanup already performed by amd_pmc_remove(). Consult the upstream commits 30e5f4d, 76f650a, and bc9aa5f for backport details.
Workarounds
- Avoid reloading the amd_pmc module on systems where prior probe attempts logged amd_stb_s2d_init failures.
- Where s2idle is not required, disable the suspend-to-idle path through firmware or kernel command-line configuration to reduce exposure.
- Blacklist the amd_pmc module on non-essential AMD test systems until the patched kernel is deployed.
# Verify kernel version and confirm the amd_pmc fix is present
uname -r
modinfo amd_pmc | grep -E 'filename|version'
dmesg | grep -iE 'amd_pmc|acpi_register_lps0_dev|list_add corruption'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.