CVE-2026-81015

The AMD PMC driver (platform/x86/amd/pmc) in the Linux kernel leaks its ACPI LPS0 s2idle registration and debugfs directory when its final probe step, amd_stb_s2d_init(), fails, because the error path only releases the PCI device reference. The stale handler remains on the global lps0_s2idle_devops_head list after the devm-managed resources backing it are torn down, so reloading the module triggers a list_add corruption kernel BUG, and even without a reload the next suspend-to-idle transition calls into freed driver state — a use-after-free that can crash or corrupt the kernel. Affected systems are x86 machines with AMD power-management hardware (typically modern AMD Ryzen laptops and desktops running Linux) where the S2D telemetry setup can fail, for example an ioremap failure on a long-running system or the SMU rejecting the S2D setup. With a CVSS of 7.8 on a local attack vector requiring only low privileges, exploitation depends on local access or naturally occurring STB-init failures rather than network exposure, and no public PoC or in-the-wild exploitation is known.

What to do: Update to a kernel release that includes this fix (the amd_stb_s2d_init() error path now unregisters the LPS0 handler and removes the debugfs directory) as soon as your distribution ships it; no fixed version number is specified in this data. Until patched, avoid unloading and reloading amd_pmc, and reboot any system that logs an amd_pmc probe failure (SMU/S2D telemetry errors in dmesg) before its next suspend-to-idle cycle. Since the flaw is local-only, keep untrusted local accounts and unprivileged module-loading paths locked down.