CVE-2026-81015: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

amd_pmc_probe() registers the LPS0 s2idle handler with
acpi_register_lps0_dev() and creates the driver's debugfs directory before
calling amd_stb_s2d_init(), which is the last step in probe that can fail.

When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot
be ioremapped on a long-running system, or the SMU rejects the S2D setup)
the error path only calls pci_dev_put() and returns.  This leaves
amd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks
the debugfs directory, while the devm-managed resources backing the handler
are torn down.

Reloading the module then walks the corrupted list in
acpi_register_lps0_dev() and hits:

  list_add corruption. next->prev should be prev, but was NULL.
  kernel BUG at lib/list_debug.c:29!
   acpi_register_lps0_dev+0x44/0x80
   amd_pmc_probe+0x224/0x380 [amd_pmc]
   platform_probe+0x67/0x90

Even without a reload, the stale registration means the next s2idle
transition calls into torn-down driver state.

Unwind the debugfs directory and the LPS0 registration on the
amd_stb_s2d_init() error path.  acpi_unregister_lps0_dev() is safe to call
unconditionally here: it is guarded on the same conditions as
acpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already
relies on.

The Linux kernel CVE team has assigned CVE-2026-81015 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit 83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8 and fixed in 6.18.50 with commit bc9aa5fe21c3966c80647ed6574b94b863f23c62
	Issue introduced in 6.14 with commit 83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8 and fixed in 7.2.4 with commit 30e5f4d0cd0be655c800f10ae3e530391aa6c1b5
	Issue introduced in 6.14 with commit 83ad6974dd3bf34c080b3c08d36d02ebc3bd6da8 and fixed in 7.3-rc1 with commit 76f650a76d6a36a4bee79d94db90a0e935a95477

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-81015
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/platform/x86/amd/pmc/pmc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bc9aa5fe21c3966c80647ed6574b94b863f23c62
	https://git.kernel.org/stable/c/30e5f4d0cd0be655c800f10ae3e530391aa6c1b5
	https://git.kernel.org/stable/c/76f650a76d6a36a4bee79d94db90a0e935a95477