CVE-2025-21784: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21784 affects the Linux kernel's AMD GPU driver (drm/amdgpu). The vulnerability was discovered and disclosed on February 26, 2025, and involves a firmware loading issue in the psp_init_cap_microcode() function. When the function fails to load firmware, it doesn't properly bail out, which can lead to invalid memory access (NVD).

The vulnerability exists in the AMD GPU driver's PSP (Platform Security Processor) initialization code. Specifically, in the psp_init_cap_microcode() function, there is a logic flaw where the function continues execution after failing to load firmware instead of properly bailing out. This issue was introduced by commit 07dbfc6b102e which implemented amdgpu_ucode helpers for PSP (Kernel Commit).

The vulnerability can result in invalid memory access when the PSP firmware fails to load properly. This could potentially lead to system instability or crashes in systems using affected AMD GPU drivers (NVD).

The vulnerability requires local access to a system with an affected AMD GPU driver. It is triggered during the initialization of the GPU's Platform Security Processor when there is a firmware loading failure (Kernel Commit).

The issue has been fixed in the Linux kernel through a patch that properly handles firmware loading failures in the psp_init_cap_microcode() function. The fix ensures that the function properly bails out when firmware loading fails, preventing invalid memory access (Kernel Commit).