Executive brief
AMD's power management controller (PMC) driver in Linux contains a flaw in its Spill-to-DRAM (S2D) feature initialization that fails to properly validate responses from the System Management Unit (SMU). When the SMU rejects commands or returns invalid data, the driver silently proceeds and may attempt to map invalid memory addresses, causing kernel warnings or potential memory corruption. This affects systems with AMD Spill-to-DRAM support that rely on this feature for diagnostic telemetry.
Technical details
The vulnerability exists in the amd_stb_s2d_init() function within drivers/platform/x86/amd/pmc/mp1_stb.c, which fails to check return values from multiple amd_pmc_send_cmd() calls when querying SMU for S2D physical addresses. When an SMU command fails, the S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH registers may remain uninitialized or return zero. The driver then assembles a physical address from these unvalidated values and passes it directly to devm_ioremap(), potentially mapping physical address 0x0. This triggers ioremap-on-RAM warnings and could lead to kernel memory corruption. The patch adds proper error propagation and validates that the assembled physical address is non-zero before mapping.
Affected products
- Linux Linux kernel affected versions include 5.x through 6.x with AMD PMC driver; patch commit 0225c1d637687b03726f00ac65b6def843d2c464
Timeline
- 2026-09-11: disclosed: CVE-2026-81016 published
- 2026-07-21: patched: Patch authored by Mario Limonciello
- 2026-07-27: patched: Patch merged to main kernel tree
- 2026-09-07: patched: Patch backported to stable kernel branches