Buffer Overflow Vulnerability in Linux Kernel's AMDGPU Driver
Summary
CVE-2025-21780: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, i... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. The AMDGPU driver is responsible for managing AMD graphics cards, providing essential functionalities for rendering graphics and handling GPU tasks. This driver is crucial for users relying on AMD hardware for gaming, graphic design, and other intensive applications. However, vulnerabilities in the driver can lead to severe security risks, including unauthorized access and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMDGPU driver, specifically in the function smu_sys_set_pp_table(). This vulnerability arises when a malicious user provides a smaller power table (pptable) through the sysfs interface followed by a larger one. This sequence can lead to a buffer overflow attack, potentially allowing the attacker to execute arbitrary code or crash the system. The vulnerability underscores the importance of validating input sizes in system calls to prevent such exploits.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the sysfs interface for non-privileged users to prevent unauthorized manipulation of the pptable. This can be done by modifying the permissions of the relevant sysfs entries.
Conclusion
The CVE-2025-21780 vulnerability in the Linux kernel's AMDGPU driver poses significant risks, including buffer overflow attacks. Users are strongly encouraged to update their systems to the latest kernel version to mitigate these risks. Additionally, implementing temporary workarounds can help protect systems until updates are applied.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21780 is a vulnerability in the Linux kernel's AMDGPU driver that can lead to a buffer overflow attack.
Exploitation of this vulnerability can allow attackers to execute arbitrary code or crash the system, leading to potential data loss or unauthorized access.
Yes, users are advised to update their Linux kernel to the latest version that includes the patch for this vulnerability.
As a temporary measure, restrict access to the sysfs interface for non-privileged users to mitigate the risk of exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
