CVE-2026-81016

A flaw was found in the Linux kernel. Specifically, within the AMD Platform Management Controller (PMC) component, the amd_stb_s2d_init() function does not properly validate memory addresses returned by System Management Unit (SMU) commands. This can result in the kernel attempting to map a critical memory region at address zero, leading to system warnings and potential instability. This issue could be exploited by a local attacker to cause a denial of service.

A flaw was found in the Linux kernel AMD Platform Management Controller (PMC) driver. In amd_stb_s2d_init(), the return values of several Spill-to-DRAM (S2D) SMU commands are discarded, so when the SMU refuses a command the failure is only noticed indirectly and masked as a generic -EIO, and the S2D_PHYS_ADDR_LOW/HIGH values are left uninitialized. The resulting physical address is passed directly to devm_ioremap(), which can map physical address 0 and trigger an ioremap-on-RAM warning and potential kernel panic. A local attacker could leverage this flaw to cause a denial of service. Red Hat rated this flaw as Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); the upstream CVEORG score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) differs because it assumes no privileges are required and a high confidentiality impact, whereas the technical evidence for this flaw shows it requires local access and affects only availability.

The kernel in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, and the RHEL 9-based RHCOS 9 components shipped in OpenShift Container Platform 4.13 and later, are affected. The fix is currently deferred for these affected streams because Red Hat does not file trackers for MODERATE severity flaws whose CVSS score is below 7.0; the residual risk is that on an affected AMD platform whose SMU refuses S2D commands, the unvalidated address passed to devm_ioremap() can lead to a kernel warning or panic, resulting in local denial of service. Red Hat Enterprise Linux 6, 7, and 8 kernels (including kernel-rt) and the RHEL 8-based RHCOS 8 component shipped in OpenShift Container Platform 4.12 are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.