Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2025-21991

x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

CVSS 7.8 HighEPSS 0.0022 · 13th percentile

Published by the CVE Program (CNA: Linux) at 2 Apr 2025, 12:53 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 979e197968a1e8f09bf0d706801dba4432f85ab3 to before d509c4731090ebd9bbdb72c70a2d70003ae81f4f git
  • affected 44a44b57e88f311c1415be1f567c50050913c149 to before 985a536e04bbfffb1770df43c6470f635a6b1073 git
  • affected be2710deaed3ab1402379a2ede30a3754fe6767a to before 18b5d857c6496b78ead2fd10001b81ae32d30cac git
  • affected d576547f489c935b9897d4acf8beee3325dea8a5 to before ec52240622c4d218d0240079b7c1d3ec2328a9f4 git
  • affected 7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before e686349cc19e800dac8971929089ba5ff59abfb0 git
  • affected 7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before 488ffc0cac38f203979f83634236ee53251ce593 git
  • affected 7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before 5ac295dfccb5b015493f86694fa13a0dde4d3665 git
  • affected 7ff6edf4fef38ab404ee7861f257e28eaaeed35f to before e3e89178a9f4a80092578af3ff3c8478f9187d59 git
  • affected d6353e2fc12c5b8f00f86efa30ed73d2da2f77be git
  • affected 1b1e0eb1d2971a686b9f7bdc146115bcefcbb960 git
  • affected eaf5dea1eb8c2928554b3ca717575cbe232b843c git
  • affected 5.4.235 to before 5.4.292 semver
  • and 6 more
Other versions: unaffected
Linux Linux
  • affected 6.3
  • unaffected before 6.3 semver
  • unaffected 5.4.292 to 5.4.*, inclusive semver
  • unaffected 5.10.236 to 5.10.*, inclusive semver
  • unaffected 5.15.180 to 5.15.*, inclusive semver
  • unaffected 6.1.132 to 6.1.*, inclusive semver
  • unaffected 6.6.84 to 6.6.*, inclusive semver
  • unaffected 6.12.20 to 6.12.*, inclusive semver
  • unaffected 6.13.8 to 6.13.*, inclusive semver
  • unaffected 6.14 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2025-21991
CNA
Linux
Weakness (CWE)
CWE-129
Tags
Published
2 Apr 2025
Updated
23 May 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.8 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ADP (CISA-ADP)
  • CISA KEV Not listed.
  • EPSS 0.0022, the 13th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 2 Apr 2025. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.