CVE-2025-52532

LowCVSS 2.0/10Last modified Oct 14, 2026

Description

A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an attacker to trigger a heap-based buffer overflow, potentially resulting in denial-of-service within the vulnerable system context.

Metrics

CVSS 4.0 2.0/10CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 15, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-525338.7Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromiCVE-2025-525345.3Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integritCVE-2025-525366.7Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting iCVE-2025-525388.0Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resultingCVE-2025-525397.3A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interfaceCVE-2025-52546.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM alloCVE-2025-525408.5An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write OutCVE-2025-525417.3A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary codCVE-2025-525437.5E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An aCVE-2025-525447.5E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floorCVE-2025-525457.5E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames andCVE-2025-525466.1E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor
CVE-2025-52532: Low severity, CVSS 2.0 | Vulnix