CVE-2026-98640

A flaw was found in the Linux kernel's AMD Sensor Fusion Hub (amd_sfh) driver. An attacker capable of attaching or emulating a crafted Peripheral Component Interconnect (PCI) device can cause a Denial of Service (DoS) through a system crash. This issue occurs because the driver fails to validate the PCI Base Address Register (BAR) size before accessing device registers, leading to an out-of-bounds memory read during device initialization.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires privileged access or physical presence to connect a specially crafted or emulated PCI device. An attacker cannot trigger the condition remotely or without elevated privileges capable of manipulating hardware interfaces. In typical Red Hat deployments, systems are not exposed to untrusted PCI devices, and successful exploitation results strictly in a denial of service through a kernel panic during device probing, without integrity or confidentiality loss.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.