UBUNTU-CVE-2026-81016: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit() discards the return value of several S2D SMU commands. When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the failure is only noticed indirectly - if at all - and reported as -EIO, masking the real error. More seriously, the S2DPHYSADDRLOW/HIGH return values are ignored, so on failure physaddrlow/hi are left uninitialised and the assembled address is passed straight to devmioremap(). When the SMU leaves them at zero this maps physical address 0 and trips the ioremap-on-RAM warning: amdpmc AMDI000B:00: SMU cmd failed. err: 0xff ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:... Check the return value of each SMU command and propagate it, and reject a zero physical address before calling devmioremap().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In amd_stb_s2d_init(), check and propagate the return value of each S2D SMU command, including S2D_PHYS_ADDR_LOW/HIGH, instead of ignoring SMU failures.
- Compensating control
Reject a zero assembled S2D physical address before passing it to devm_ioremap().
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The severity vector indicates local access is required. It indicates no privileges or user interaction are required, and the potential impact includes high confidentiality and availability impact.
Which systems are most relevant to triage?
The affected code is in the x86 AMD Platform Management Controller driver. Systems using the AMD PMC device, shown in the example as AMDI000B:00, are the relevant population; the listed Ubuntu kernel packages include linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What evidence in logs may indicate the faulty path has been reached?
Look for AMD PMC messages such as "SMU cmd failed. err: 0xff" followed by an "ioremap on RAM" warning for physical address 0x0000000000000000. These messages indicate that an SMU command failed and a zero address may have been used for mapping.