# x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

CVE record · `CVE-2025-21991`

- **Identifiers:** `CVE-2025-21991`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-129](https://cwe.mitre.org/data/definitions/129.html)
- **Tags:** [CWE-129](https://agentprime.io/advisories/tag/cwe-129.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 2 Apr 2025
- **Updated:** 23 May 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 2 Apr 2025, 12:53 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `979e197968a1e8f09bf0d706801dba4432f85ab3 to before d509c4731090ebd9bbdb72c70a2d70003ae81f4f` (git)
  - affected: `44a44b57e88f311c1415be1f567c50050913c149 to before 985a536e04bbfffb1770df43c6470f635a6b1073` (git)
  - affected: `be2710deaed3ab1402379a2ede30a3754fe6767a to before 18b5d857c6496b78ead2fd10001b81ae32d30cac` (git)
  - affected: `d576547f489c935b9897d4acf8beee3325dea8a5 to before ec52240622c4d218d0240079b7c1d3ec2328a9f4` (git)
  - affected: `7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before e686349cc19e800dac8971929089ba5ff59abfb0` (git)
  - affected: `7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before 488ffc0cac38f203979f83634236ee53251ce593` (git)
  - affected: `7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before 5ac295dfccb5b015493f86694fa13a0dde4d3665` (git)
  - affected: `7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before e3e89178a9f4a80092578af3ff3c8478f9187d59` (git)
  - affected: `d6353e2fc12c5b8f00f86efa30ed73d2da2f77be` (git)
  - affected: `1b1e0eb1d2971a686b9f7bdc146115bcefcbb960` (git)
  - affected: `eaf5dea1eb8c2928554b3ca717575cbe232b843c` (git)
  - affected: `5.4.235 to before 5.4.292` (semver)
  - and 6 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `6.3`
  - unaffected: `before 6.3` (semver)
  - unaffected: `5.4.292 to 5.4.*, inclusive` (semver)
  - unaffected: `5.10.236 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.180 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.132 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.84 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.20 to 6.12.*, inclusive` (semver)
  - unaffected: `6.13.8 to 6.13.*, inclusive` (semver)
  - unaffected: `6.14 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from ADP (CISA-ADP)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0022, the 13th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 2 Apr 2025. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2025-21991](https://www.cve.org/CVERecord?id=CVE-2025-21991)
- [NVD: CVE-2025-21991](https://nvd.nist.gov/vuln/detail/CVE-2025-21991)

### References from the CNA

- <https://git.kernel.org/stable/c/d509c4731090ebd9bbdb72c70a2d70003ae81f4f>
- <https://git.kernel.org/stable/c/985a536e04bbfffb1770df43c6470f635a6b1073>
- <https://git.kernel.org/stable/c/18b5d857c6496b78ead2fd10001b81ae32d30cac>
- <https://git.kernel.org/stable/c/ec52240622c4d218d0240079b7c1d3ec2328a9f4>
- <https://git.kernel.org/stable/c/e686349cc19e800dac8971929089ba5ff59abfb0>
- <https://git.kernel.org/stable/c/488ffc0cac38f203979f83634236ee53251ce593>
- <https://git.kernel.org/stable/c/5ac295dfccb5b015493f86694fa13a0dde4d3665>
- <https://git.kernel.org/stable/c/e3e89178a9f4a80092578af3ff3c8478f9187d59>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2025-21991>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2025-21991/>. Everything for agents: <https://agentprime.io/llms.txt>.