CVE-2026-98640

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: amd_sfh: Validate PCI BAR size before mapping

The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and

subsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,

AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR

size is large enough to cover these accesses. If the driver is bound to a

device with a smaller BAR 2, this leads to an out-of-bounds memory access

and a page fault during the probe function.

For example, a page fault can occur when reading from privdata->mmio +

AMD_P2C_MSG3 in mp2_select_ops():

BUG: unable to handle page fault for address: ffffc9000390368c

PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]

RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282

[inline]

RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0

drivers/hid/amd-sfh-h

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References