CVE-2026-81016

platform/x86/amd/pmc: Propagate SMU errors and validate S2D address

State: Published
Severity: 7.7 High
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Propagate SMU errors and validate S2D address

amd_stb_s2d_init() discards the return value of several S2D SMU commands. When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the failure is only noticed indirectly - if at all - and reported as -EIO, masking the real error.

More seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so on failure phys_addr_low/hi are left uninitialised and the assembled address is passed straight to devm_ioremap(). When the SMU leaves them at zero this maps physical address 0 and trips the ioremap-on-RAM warning:

amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:...

Check the return value of each SMU command and propagate it, and reject a zero physical address before calling devm_ioremap().

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 646cdcc6c7594d8ad81577b2cb05276a927edc28Affected 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 85ef9d4c384c1d143c51580933674d94dba3b8d9Affected 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 638e1ca5d4e2b4fdbb209db64926d013b34f3b79Affected 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 8178f59d76570b152d836bde07f5997f15861f04Affected 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 775d4cde1f9737796ce7d8393521e9e8c5b49891Affected 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 0225c1d637687b03726f00ac65b6def843d2c464Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 646cdcc6c7594d8ad81577b2cb05276a927edc28Affected
3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 85ef9d4c384c1d143c51580933674d94dba3b8d9Affected
3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 638e1ca5d4e2b4fdbb209db64926d013b34f3b79Affected
3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 8178f59d76570b152d836bde07f5997f15861f04Affected
3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 775d4cde1f9737796ce7d8393521e9e8c5b49891Affected
3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d to before 0225c1d637687b03726f00ac65b6def843d2c464Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.