CVE-2026-98640
Received Received - Intake

Buffer Overflow in AMD SFH HID Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Validate PCI BAR size before mapping The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function. For example, a page fault can occur when reading from privdata->mmio + AMD_P2C_MSG3 in mp2_select_ops(): BUG: unable to handle page fault for address: ffffc9000390368c PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282 [inline] RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0 drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487 Call Trace: <TASK> local_pci_probe drivers/pci/pci-driver.c:332 [inline] pci_call_probe drivers/pci/pci-driver.c:394 [inline] __pci_device_probe drivers/pci/pci-driver.c:455 [inline] pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489 Fix this by verifying that the length of BAR 2 is at least 128KB before attempting to map it. Since the maximum accessed offset is 0x10958, and PCI BAR sizes are powers of 2, any legitimate hardware will have a BAR size of at least 128KB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98640
EUVD
EUVD-2026-103554

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 4f567b9f8141a86c7d878fadf136e5d1408e3e61
Linux Linux 5.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's HID driver for AMD's Sensor Fusion Hub (amd_sfh). The driver maps PCI BAR 2 without validating its size. If the BAR is too small, accessing MMIO registers at offsets up to 0x10958 causes an out-of-bounds memory access, leading to a page fault during device probe.

Detection Guidance

This vulnerability is specific to the Linux kernel's amd_sfh driver and requires checking the PCI BAR size of the AMD Sensor Fusion Hub device. No network detection commands are applicable. On the affected system, check the PCI device and driver binding with commands like lspci -nn | grep -i amd, lspci -vvs <device> and dmesg for page fault errors during driver probe.

Impact Analysis

If exploited, this flaw can crash the system with a kernel page fault when the affected driver initializes. This may cause system instability, data loss, or denial of service during boot or device hotplugging.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98640. The fix validates PCI BAR 2 size before mapping. If updating is not immediately possible, avoid using the amd_sfh driver or disable the AMD Sensor Fusion Hub device in BIOS/UEFI until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart