{"id":"CVE-2026-98640","kind":"vulnerability","aliases":["CVE-2026-98640"],"related":[],"title":"Linux kernel: AMD sensor hub driver crashes on undersized PCI BAR","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Validate PCI BAR size before mapping\n\nThe amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and\nsubsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,\nAMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR\nsize is large enough to cover these accesses. If the driver is bound to a\ndevice with a smaller BAR 2, this leads to an out-of-bounds memory access\nand a page fault during the probe function.\n\nFor example, a page fault can occur when reading from privdata->mmio +\nAMD_P2C_MSG3 in mp2_select_ops():\n\n  BUG: unable to handle page fault for address: ffffc9000390368c\n  PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]\n  RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282\n  [inline]\n  RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0\n  drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487\n  Call Trace:\n   <TASK>\n   local_pci_probe drivers/pci/pci-driver.c:332 [inline]\n   pci_call_probe drivers/pci/pci-driver.c:394 [inline]\n   __pci_device_probe drivers/pci/pci-driver.c:455 [inline]\n   pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489\n\nFix this by verifying that the length of BAR 2 is at least 128KB before\nattempting to map it. Since the maximum accessed offset is 0x10958, and PCI\nBAR sizes are powers of 2, any legitimate hardware will have a BAR size of\nat least 128KB.","summary":"The amd_sfh HID driver maps PCI BAR 2 without checking its size, so a device exposing a smaller BAR causes an out-of-bounds MMIO read and a kernel page fault during probe. The sources describe a kernel oops (denial of service) and do not describe code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd","hid","kernel","laptops","linux","runtime"],"not_affected_if":["driver-not-loaded","no-amd-sfh-device"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel version in the upstream commit, which the sources do not name.\n- Run `lspci -v` and look for an AMD sensor fusion hub (MP2) device; check whether its BAR 2 region is smaller than 128KB.","fix":"- Update to a Linux kernel build that includes the upstream commit 'HID: amd_sfh: Validate PCI BAR size before mapping'; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:56+00:00","updated_at":"2026-10-25T05:20:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:20:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream commit 'HID: amd_sfh: Validate PCI BAR size before mapping'; the fixed version is unknown from the sources.","reach":"local","title":"Linux kernel: AMD sensor hub driver crashes on undersized PCI BAR","impact":"low","summary":"The amd_sfh HID driver maps PCI BAR 2 without checking its size, so a device exposing a smaller BAR causes an out-of-bounds MMIO read and a kernel page fault during probe. The sources describe a kernel oops (denial of service) and do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","amd","hid","laptops"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel page fault during probe crashes the machine (denial of service).","analyst_note":"Find the fixed kernel version and the upstream commit from the NVD or kernel.org record for CVE-2026-98640.","how_to_check":"- Run `uname -r` and compare against the fixed kernel version in the upstream commit, which the sources do not name.\n- Run `lspci -v` and look for an AMD sensor fusion hub (MP2) device; check whether its BAR 2 region is smaller than 128KB.","needs_analyst":true,"not_affected_if":["no-amd-sfh-device","driver-not-loaded"],"who_is_affected":"Systems with an AMD sensor fusion hub (MP2) device bound to the amd_sfh driver, where the BAR 2 region is smaller than the driver expects. Machines without that AMD sensor hardware or without the amd_sfh driver loaded are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000708,"input_tokens":3961,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':233C,260C '-2026':13A,16A '-98640':14A,17A '0':205C '0000':208C '0010':214C,220C,228C '0x1068c':120C '0x10958':114C,289C '1':209C '100000067':197C,199C '1012c1067':201C '105b64067':203C '128kb':277C,309C '2':32B,100C,149C,273C,297C '282':225C '332':243C '394':249C '455':255C '487':236C '489':263C '59':217C 'access':107C,136C,159C,286C 'address':194C 'amd':3A,18B,25B,85C,94C,116C,180C,229C 'arch/x86/include/asm/io.h':216C 'attempt':279C 'bar':11A,31B,43B,89C,99C,128C,148C,272C,292C,304C 'bound':49B,141C,157C 'bug':187C 'call':237C,246C 'caus':44B 'check':34B 'code':72B 'cover':134C 'crash':7A 'cve':12A,15A 'denial':65B 'describ':61B,71B 'devic':39B,144C,252C,258C 'driver':6A,28B,96C,123C,139C 'drivers/hid/amd-sfh-hid/amd_sfh_pcie.c':224C,235C 'drivers/pci/pci-driver.c':242C,248C,254C,262C 'e.g':115C 'enough':132C 'exampl':169C 'execut':73B 'expos':40B 'fault':56B,163C,172C,192C 'ffffc9000390368c':195C 'fix':264C 'follow':79C 'function':167C 'handl':190C 'hardwar':300C 'hid':19B,27B,84C 'howev':121C 'hub':5A 'inlin':218C,226C,244C,250C,256C 'iomap':103C 'kasan':211C 'kernel':2A,20B,54B,63B,77C 'laptop':21B 'larg':131C 'lead':151C 'least':276C,308C 'legitim':299C 'length':270C 'linux':1A,22B,76C 'local':239C 'map':29B,92C,97C,281C 'maximum':285C 'memori':158C 'mmio':50B,108C,179C 'mp2':184C,221C,230C 'msg3':118C,182C 'never':124C 'nopti':212C 'occur':174C 'offset':111C,287C 'oop':64B,206C,207C 'op':186C,223C 'out-of-bound':46B,154C 'p2c':117C,181C 'p4d':198C 'page':55B,162C,171C,191C 'pci':10A,30B,88C,98C,231C,240C,245C,251C,257C,291C 'pcim':102C 'pgd':196C 'pmd':202C 'power':295C 'privdata':178C 'probe':58B,166C,232C,241C,247C,253C,259C 'pte':204C 'pud':200C 'read':51B,176C 'readl':215C 'region':104C 'regist':109C 'resolv':83C 'rip':213C,219C,227C 'runtim':23B 'select':185C,222C 'sensor':4A 'servic':67B 'sfh':26B,86C,95C 'sinc':283C 'size':36B,90C,129C,293C,305C 'smaller':42B,147C 'smp':210C 'sourc':60B 'subsequ':106C 'trace':238C 'unabl':188C 'unders':9A 'use':101C 'valid':87C,125C 'verifi':267C 'vulner':80C 'without':33B 'x337/0x5f0':234C 'x431/0xc90':261C","nicknames":[],"mitigations":[],"who_affected":"Systems with an AMD sensor fusion hub (MP2) device bound to the amd_sfh driver, where the BAR 2 region is smaller than the driver expects. Machines without that AMD sensor hardware or without the amd_sfh driver loaded are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98640","severity":null,"published_at":"2026-10-18T16:17:17+00:00","modified_at":"2026-10-19T10:19:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}