CVE-2025-21780

What it actually does

Buffer overflow in smu_sys_set_pp_table() triggered when a small powerplay table is supplied via sysfs followed by a larger one, allowing out-of-bounds writes in the AMDGPU driver.

Why it matters to the business

Attackers with local access on systems using AMD GPUs can potentially escalate privileges or crash the kernel, leading to service disruption or full system compromise on Linux servers and workstations; the issue has been public for over 600 days with related kernel privilege-escalation techniques observed in the wild.

How an attack unfolds

An attacker with write access to the relevant sysfs interface supplies a small pptable, then follows it with a larger pptable to trigger the buffer overflow in smu_sys_set_pp_table(); similar techniques appear in other Linux kernel privilege-escalation chains used by threat actors targeting containerized and cloud environments.

How to fix it

Upgrade the Linux kernel to a version containing commit 3484ea33157bc7334f57e64826ec5a4bf992151a in the stable tree; apply the patch that prevents the size-change buffer overflow in smu_sys_set_pp_table().

How to confirm the fix worked

Confirm the running kernel contains commit 3484ea33157bc7334f57e64826ec5a4bf992151a or later equivalent; inspect the smu_sys_set_pp_table() function for the added size validation check.

Typical attack path

1. Obtain local user access on a Linux system with AMDGPU hardware
2. Locate and write a small powerplay table to the exposed sysfs node
3. Immediately follow with a larger powerplay table to overflow the buffer
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review sysfs audit logs and kernel audit events for unusual write sequences to amdgpu powerplay table nodes; correlate with process execution of tools that interact with /sys/class/drm or debugfs amdgpu entries around the time of suspected exploitation.

• /sys/class/drm/card*/device/pp_table
• smu_sys_set_pp_table
• amdgpu powerplay table write sequence

What your security team should do

• Immediately update all AMDGPU-enabled Linux kernels to the fixed commit 3484ea33157bc7334f57e64826ec5a4bf992151a
• Restrict unprivileged write access to AMDGPU sysfs powerplay interfaces via mount options or SELinux/AppArmor policies
• Monitor for new kernel releases and schedule broad fleet patching within the next maintenance window