CVE-2026-81015

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

amd pmc probe() registers the LPS0 s2idle handler with acpi register lps0 dev() and creates the driver's debugfs directory before calling amd stb s2d init(), which is the last step in probe that can fail.

When amd stb s2d init() fails (for example the S2D telemetry region cannot be ioremapped on a long-running system, or the SMU rejects the S2D setup) the error path only calls pci dev put() and returns. This leaves amd pmc s2idle dev ops on the global lps0 s2idle devops head list and leaks the debugfs directory, while the devm-managed resources backing the handler are torn down.

Reloading the module then walks the corrupted list in acpi register lps0 dev() and hits:

list add corruption. next->prev should be prev, but was NULL. kernel BUG at lib/list debug.c:29! acpi register lps0 dev+0x44/0x80 amd pmc probe+0x224/0x380 [amd pmc] platform probe+0x67/0x90

Even without a reload, the stale registration means the next s2idle transition calls into torn-down driver state.

Unwind the debugfs directory and the LPS0 registration on the amd stb s2d init() error path. acpi unregister lps0 dev() is safe to call unconditionally here: it is guarded on the same conditions as acpi register lps0 dev(), which is exactly what amd pmc remove() already relies on.