CVE-2025-21991

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their

CPU masks and unconditionally accesses per-CPU data for the first CPU of each

mask.

According to Documentation/admin-guide/mm/numaperf.rst:

"Some memory may share the same node as a CPU, and others are provided as

memory only nodes."

Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".

On a machine with far memory (and therefore CPU-less NUMA nodes):

- cpumask_of_node(nid) is 0

- cpumask_first(0) is CONFIG_NR_CPUS

- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an

index that is 1 out of bounds

This does not have any security implications since flashing microcode is

a privileged operation but I believe this has reliability implications by

potentially corrupting memory while flashing a microcode update.

When booting w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References