CVE-2026-98640: HID: amd_sfh: Validate PCI BAR size before mapping
In the Linux kernel, the following vulnerability has been resolved:
HID: amdsfh: Validate PCI BAR size before mapping
The amdsfh driver maps PCI BAR 2 using pcimiomapregions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMDP2CMSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.
For example, a page fault can occur when reading from privdata->mmio + AMDP2CMSG3 in mp2selectops():
BUG: unable to handle page fault for address: ffffc9000390368c PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:mp2selectops drivers/hid/amd-sfh-hid/amdsfhpcie.c:282 [inline] RIP: 0010:amdmp2pciprobe+0x337/0x5f0 drivers/hid/amd-sfh-hid/amdsfhpcie.c:487 Call Trace: <TASK> localpciprobe drivers/pci/pci-driver.c:332 [inline] pcicallprobe drivers/pci/pci-driver.c:394 [inline] pcideviceprobe drivers/pci/pci-driver.c:455 [inline] pcideviceprobe+0x431/0xc90 drivers/pci/pci-driver.c:489
Fix this by verifying that the length of BAR 2 is at least 128KB before attempting to map it. Since the maximum accessed offset is 0x10958, and PCI BAR sizes are powers of 2, any legitimate hardware will have a BAR size of at least 128KB.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Before mapping PCI BAR 2 in the amd_sfh driver, verify that its length is at least 128KB; do not map or probe devices with a smaller BAR 2.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems are exposed when the Linux kernel amd_sfh driver binds to a device whose PCI BAR 2 is smaller than the MMIO register offsets accessed by the driver. The described failure occurs during driver probe.
What is required to trigger the failure?
The driver must be bound to a device with an undersized BAR 2. Accessing an MMIO register at an offset beyond that BAR can cause an out-of-bounds memory access and page fault.
How can I identify an affected failure on a host?
Look for a kernel page fault or Oops during amd_sfh driver probing, with stack frames including mp2_select_ops and amd_mp2_pci_probe. The example fault occurs while reading the AMD_P2C_MSG3 register at offset 0x1068C.
What mitigation is described if the fix is not yet deployed?
The provided information does not describe a workaround. The resolved issue is addressed by validating PCI BAR size before mapping and accessing the MMIO region.