CVE-2026-53121amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() On failure to set the epp, the function amd_pstate_epp_cpu_init() returns with an error code without freeing the cpudata object that was allocated at the beginning of the function. Ensure that the cpudata object is freed before returning from the function. This memory leak was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts (https://github.com/masoncl/review-prompts/tree/main/kernel).
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Jun 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f9a378ff6443cdcd4387e5dbb76fa5fa549a83ec before 539aabbab190825c77eb455ec35652cb3720625f; from f9a378ff6443cdcd4387e5dbb76fa5fa549a83ec before 7f9aa2359742eaa6ea65ec0d20dafdfd0add9b8b; from f9a378ff6443cdcd4387e5dbb76fa5fa549a83ec before beda3b363546a423e4e29a7395e04c0ac4ff677e | CNA record |
linux linux_kernel linux:linux_kernel | from 6.14 before 6.18.33; from 6.19 before 7.0.10 | NVD |
References
- https://git.kernel.org/stable/c/539aabbab190825c77eb455ec35652cb3720625fpatch
- https://git.kernel.org/stable/c/7f9aa2359742eaa6ea65ec0d20dafdfd0add9b8bpatch
- https://git.kernel.org/stable/c/beda3b363546a423e4e29a7395e04c0ac4ff677epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.