CVE-2026-53121: Linux AMD P-State Memory Leak Vulnerability

Technical summary

CVE-2026-53121 is a memory leak (CWE-401) in the amd_pstate_epp_cpu_init() function within the Linux kernel's AMD P-State frequency scaling driver. The function allocates a cpudata object early in its execution path but fails to deallocate it if the subsequent epp (energy performance preference) configuration step fails. The unfreed memory persists in the kernel heap, consuming system resources. An unprivileged local user can trigger this condition through repeated CPU frequency scaling operations or initialization attempts, causing gradual memory exhaustion. The vulnerability is confined to systems where AMD P-State is the active frequency scaling driver.

Business impact

For Linux-based infrastructure, this vulnerability poses a denial-of-service risk through resource exhaustion. On systems where CPU hotplug or frequency scaling is frequent—such as cloud environments with dynamic workload scaling, containerized platforms, or power-managed edge devices—repeated trigger events could accelerate memory depletion and system instability. While not an immediate critical threat, the cumulative effect on availability and the need for kernel updates introduce operational overhead. Systems in production environments should prioritize patching to avoid unpredictable downtime from memory pressure.

Affected systems

The vulnerability affects all versions of the Linux kernel that include the AMD P-State driver with the vulnerable amd_pstate_epp_cpu_init() function. This includes modern enterprise and consumer systems using AMD processors with frequency scaling support. The impact is limited to systems where AMD P-State is explicitly enabled as the CPU frequency scaling mechanism. Systems using alternative drivers (ACPI cpufreq or intel-pstate on non-AMD hardware) are unaffected. Verify your kernel version and P-State driver configuration to confirm exposure.

Exploitability

Exploitation requires local system access and the ability to trigger CPU initialization or frequency scaling operations—a capability available to unprivileged users on most systems. No network access or elevated privileges are required for the initial trigger, though the practical impact (memory exhaustion) develops gradually over repeated invocations. The vulnerability is not actively exploited in the wild according to available threat intelligence, and no public exploit code has been released. The barrier to discovery and weaponization is low, making proactive patching advisable.

Remediation

Apply the latest Linux kernel update from your distribution, which includes the fix to properly deallocate the cpudata object in the amd_pstate_epp_cpu_init() function before returning error conditions. Verify against your vendor's security advisories for specific patch versions. For systems unable to update immediately, consider disabling AMD P-State and reverting to an alternative frequency scaling driver if operationally feasible. Monitor kernel logs for initialization failures that may indicate trigger events.

Patch guidance

Consult your Linux distribution's security advisory for the specific patched kernel version addressing CVE-2026-53121. Most major distributions (Red Hat, Ubuntu, Debian, SUSE, etc.) have released updates—verify availability and deployment schedule with your vendor. Test patched kernels in non-production environments before rolling out broadly, particularly on systems with critical CPU frequency scaling requirements. The fix is minimal and focused, reducing regression risk. Enable automatic security updates where policy permits to ensure timely deployment.

Detection guidance

Monitor system logs (dmesg, journalctl) for repeated amd_pstate_epp_cpu_init() errors or CPU initialization failures. Track kernel memory usage over time—sustained growth despite stable workload patterns may indicate active exploitation. Use sar or similar tools to correlate memory pressure spikes with CPU frequency scaling events. On systems with detailed tracing enabled, instrument the amd_pstate driver initialization path to detect failure branches. Automated alerting on kernel memory pressure thresholds can flag early-stage resource exhaustion before user-visible impact.

Why prioritize this

With a CVSS score of 5.5 (Medium) and no active KEV designation, this vulnerability merits standard patching cycles rather than emergency response. However, the cumulative nature of memory leaks and the prevalence of AMD-based Linux infrastructure warrant elevation above routine updates, particularly for systems with high CPU scaling frequency (cloud providers, HPC clusters). The low exploitability barrier and broad affected population justify proactive outreach to users and rapid patch deployment within maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity rating driven by local-only attack requirements (AV:L), low complexity (AC:L), and moderate privilege requirements (PR:L). The impact is denial of service through availability degradation (A:H), with no confidentiality or integrity impact. The score appropriately captures that exploitation requires local presence but is trivial to trigger. Real-world risk depends heavily on deployment context: systems with frequent CPU hotplug operations or multi-tenant environments face elevated practical risk despite the standard CVSS assessment.

Frequently asked questions