CVE-2025-21991

Summary

CVE-2025-21991: A vulnerability was identified in the Linux kernel's AMD microcode handling. The issue lies in the function load_microcode_amd(), which unconditionally accesses per-CPU data for the first CPU on each NUMA node, even if the node has no CPUs. This out-of-bounds access can potentially corrupt memory during microcode updates on systems with CPU-less NUMA nodes, leading to reliability issues. The vulnerability does not have any known security implications, but it can cause memory corruption while flashing microcode updates. A fix has been implemented to modify the loop in load_microcode_amd() to only check NUMA nodes with CPUs before determining if a microcode update is required for their first CPU.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.