HIGH Introduced in 5.18
amd_pmc S2D Init Deref
CVE-2026-81016
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI5.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd_stb_s2d_init() discards the return value of several S2D SMU commands. When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the failure is only noticed indirectly - if at all - and reported as -EIO, masking the real error. More seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so on failure phys_addr_low/hi are left uninitialised and the assembled address is passed straight to devm_ioremap(). When the SMU leaves them at zero this maps physical address 0 and trips the ioremap-on-RAM warning: amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:... Check the return value of each SMU command and propagate it, and reject a zero physical address before calling devm_ioremap().
02KernelScan AI Analysis
Risk summary
On AMD platforms with the Spill-to-DRAM STB feature, a failed SMU command during initialization can leave physical address variables uninitialized, causing the driver to attempt ioremap on physical address 0 (RAM), triggering a kernel warning and potential system instability. This requires AMD hardware with the S2D feature and is triggered during driver initialization, not by an attacker-controlled input.
Vulnerability analysis
The AMD PMC driver's Spill-to-DRAM initialization function discards the return values of several SMU (System Management Unit) commands. When the SMU rejects a command, the physical address low/high values remain uninitialized (or zero), and the driver proceeds to pass this invalid address to devm_ioremap(), which attempts to map physical address 0 as I/O memory, triggering an ioremap-on-RAM kernel warning. The fix checks the return value of each SMU command and propagates errors, and explicitly rejects a zero physical address before attempting the ioremap. This vulnerability is reachable only on AMD hardware that supports the Spill-to-DRAM STB feature, during driver initialization, and does not require any attacker-controlled input — it is triggered by SMU firmware behavior.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.18 | 6.12.112 | 638e1ca5d4e2 |
| 6.18 | 5.18 | 6.18.50 | 8178f59d7657 |
| 6.6 | 5.18 | 6.6.160 | 85ef9d4c384c |
| 7.2 | 5.18 | 7.2.4 | 775d4cde1f97 |
| mainline | 5.18 | 7.3 | 0225c1d63768 |
| cip/6.12 | 5.18 | 6.12.112-cip33 | 638e1ca5d4e2 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |