A flaw in the Linux kernel amd_pmc driver allows a local, authenticated attacker to trigger a kernel panic and potential system instability through resource leakage and list corruption.

This is a resource management error (CWE-404) within the amd_pmc_probe function. When initialization fails, the driver fails to properly unregister the LPS0 s2idle handler and remove debugfs directories, which results in a kernel list corruption vulnerability when the module is reloaded or accessed.

Successful exploitation of this vulnerability can lead to a denial of service (DoS) state, as the resulting kernel bug triggers a system panic. Given the CVSS score of 7.8, this flaw represents a significant risk to system availability, particularly for servers and workstations utilizing AMD platform management controllers, as it allows a low-privileged local user to crash the host operating system.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or later, as these versions contain the necessary fixes to properly handle probe initialization failures.

Proactive Monitoring: Monitor system logs for kernel BUG messages or list corruption errors, particularly following module loading sequences or power state transitions.

Compensating Controls: Limit access to the local machine to authorized users only, as the vulnerability requires local access to the system to trigger the driver probe failure.

Public Exploit Available: Unknown

While this vulnerability requires local access, the potential for a kernel-level denial of service makes it a high-priority item for system administrators. Organizations should plan to roll out kernel updates to the affected Linux distributions to ensure the amd_pmc driver correctly cleans up resources during initialization failures, thereby preventing potential system crashes.