Cloudanix VulnDB

CVE-2026-98640

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing size check in a Linux hardware driver can cause the computer to crash when it tries to talk to certain devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The amd_sfh driver maps PCI BAR 2 without validating its size and then performs MMIO reads at offsets up to 0x10958; when the BAR is smaller than required this produces an out-of-bounds read that triggers a kernel page fault in mp2_select_ops during amd_mp2_pci_probe.

Why it matters to the business

Systems using the affected driver on hardware reporting a BAR 2 smaller than 128 KB may experience a kernel crash or boot failure, leading to loss of HID functionality and unplanned downtime.

How an attack unfolds

An attacker supplies or emulates a PCI device whose BAR 2 reports a size smaller than 128 KB; when the kernel binds the amd_sfh driver the probe routine maps the undersized region and subsequently dereferences an address beyond the BAR, causing an unhandled page fault that crashes the kernel.

How to fix it

Apply a kernel update containing the upstream fix that checks BAR 2 length is at least 128 KB before mapping; rebuild and deploy the updated kernel image to all affected hosts.

How to confirm the fix worked

Boot with the patched kernel and confirm absence of the page-fault oops in dmesg when the driver probes; optionally inspect the source of amd_sfh_pcie.c for the added length check against 0x20000.

Typical attack path

  1. Attacker presents or forces binding of a PCI device with undersized BAR 2
  2. Kernel loads amd_sfh driver and calls amd_mp2_pci_probe
  3. Driver calls pcim_iomap_regions on BAR 2 without size validation
  4. Subsequent readl at privdata->mmio + AMD_P2C_MSG3 accesses unmapped address
  5. Page fault handler terminates the probe and may panic the kernel

How to detect it

Search kernel logs and crash dumps for the strings "unable to handle page fault", "mp2_select_ops", and "amd_mp2_pci_probe"; correlate with PCI device enumeration events around the same timestamp.

  • BUG: unable to handle page fault for address
  • mp2_select_ops
  • amd_mp2_pci_probe+0x337
  • amd_sfh_pcie.c:282
  • amd_sfh_pcie.c:487

What your security team should do

  • Prioritize kernel updates on systems exposing the amd_sfh driver
  • Add kernel oops monitoring rules that alert on amd_sfh_pcie.c page faults
  • Test driver loading in lab environments with varied BAR sizes before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Validate PCI BAR size before mapping The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function. For example, a page fault can occur when reading from privdata->mmio + AMD_P2C_MSG3 in mp2_select_ops(): BUG: unable to handle page fault for address: ffffc9000390368c PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282 [inline] RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0 drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487 Call Trace: <TASK> local_pci_probe drivers/pci/pci-driver.c:332 [inline] pci_call_probe drivers/pci/pci-driver.c:394 [inline] __pci_device_probe drivers/pci/pci-driver.c:455 [inline] pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489 Fix this by verifying that the length of BAR 2 is at least 128KB before attempting to map it. Since the maximum accessed offset is 0x10958, and PCI BAR sizes are powers of 2, any legitimate hardware will have a BAR size of at least 128KB.

Affected packages

Ecosystem Package Introduced Fixed