VulnerabilityPublished 18 Oct 2026

CVE-2026-98640: Linux kernel · HID: amd_sfh: Validate PCI BAR size before mapping

Source GCVE Database

Authoritative record:CVE-2026-98640· Medium

Not known to be exploited · fixed in ee25833f037fa22d23ffdbfeebabe3579e8a0346 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ee25833f037fa22d23ffdbfeebabe3579e8a0346, dc687489131559ee52f447592f6d039a5a013061, 92bf2883da0306ab9d1eb794acd1058fc5088ebc +4

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-5m32-w674-2xq4

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 4f567b9f8141a86c7d878fadf136e5d1408e3e61, < ee25833f037fa22d23ffdbfeebabe3579e8a0346	Fixed in ee25833f037fa22d23ffdbfeebabe3579e8a0346
LinuxLinux	Affected ≥ 4f567b9f8141a86c7d878fadf136e5d1408e3e61, < dc687489131559ee52f447592f6d039a5a013061	Fixed in dc687489131559ee52f447592f6d039a5a013061
LinuxLinux	Affected ≥ 4f567b9f8141a86c7d878fadf136e5d1408e3e61, < 92bf2883da0306ab9d1eb794acd1058fc5088ebc	Fixed in 92bf2883da0306ab9d1eb794acd1058fc5088ebc
LinuxLinux	Affected ≥ 4f567b9f8141a86c7d878fadf136e5d1408e3e61, < 65bcc5f89704efe5b9d69d4ea2c1002d90c31382	Fixed in 65bcc5f89704efe5b9d69d4ea2c1002d90c31382
LinuxLinux	Affected ≥ 4f567b9f8141a86c7d878fadf136e5d1408e3e61, < 7b3747d77767f066ccf4a9e8e3a8381643ab5368	Fixed in 7b3747d77767f066ccf4a9e8e3a8381643ab5368
LinuxLinux	Affected ≥ 4f567b9f8141a86c7d878fadf136e5d1408e3e61, < 5ff24aa7af0bca0780fe4e6effce902065f2c0a7	Fixed in 5ff24aa7af0bca0780fe4e6effce902065f2c0a7

AI-suggested

A fix is available that validates the PCI BAR 2 size before mapping it in the amd_sfh driver. Systems should apply the updated Linux kernel version containing this fix. Since this is a kernel driver issue, updating the kernel to a patched version is the recommended remediation.

Description

A vulnerability in the Linux kernel's amd_sfh driver was resolved by validating the PCI BAR 2 size before mapping. The driver previously accessed memory offsets beyond the actual size of BAR 2 without validation, causing out-of-bounds memory access and potential page faults during device probing.

Impact

This vulnerability can cause kernel page faults and crashes during device probing if the driver accesses memory beyond the allocated BAR 2 size. This may lead to system instability or denial of service on affected systems running the vulnerable driver.

Summary

The amd_sfh driver in the Linux kernel maps PCI BAR 2 using pcim_iomap_regions() and accesses MMIO registers up to offset 0x10958. However, it did not verify that BAR 2's size was sufficient to cover these accesses. If bound to a device with a smaller BAR 2, this results in out-of-bounds memory access and a page fault during the probe function. The fix involves checking that BAR 2 is at least 128KB in size before mapping, ensuring safe access since PCI BAR sizes are powers of two and the maximum accessed offset requires at least 128KB.

References

Community reviews

Loading reviews…