Live › vulnerability › CVE-2026-98640
Go to dashboardThe amd_sfh HID driver maps PCI BAR 2 without checking its size, so a device exposing a smaller BAR causes an out-of-bounds MMIO read and a kernel page fault during probe. The sources describe a kernel oops (denial of service) and do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems with an AMD sensor fusion hub (MP2) device bound to the amd_sfh driver, where the BAR 2 region is smaller than the driver expects. Machines without that AMD sensor hardware or without the amd_sfh driver loaded are not affected.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel version in the upstream commit, which the sources do not name.lspci -v and look for an AMD sensor fusion hub (MP2) device; check whether its BAR 2 region is smaller than 128KB.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
HID: amd_sfh: Validate PCI BAR size before mapping
The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.
For example, a page fault can occur when reading from privdata->mmio + AMD_P2C_MSG3 in mp2_select_ops():
BUG: unable to handle page fault for address: ffffc9000390368c PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282 [inline] RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0 drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487 Call Trace: <TASK> local_pci_probe drivers/pci/pci-driver.c:332 [inline] pci_call_probe drivers/pci/pci-driver.c:394 [inline] __pci_device_probe drivers/pci/pci-driver.c:455 [inline] pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489
Fix this by verifying that the length of BAR 2 is at least 128KB before attempting to map it. Since the maximum accessed offset is 0x10958, and PCI BAR sizes are powers of 2, any legitimate hardware will have a BAR size of at least 128KB.
This page as .md · .json · in your agent: get_signal("CVE-2026-98640")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.