Executive brief
The Linux kernel's AMD HSMP (Host System Management Port) hwmon interface failed to validate negative values written to the power1_cap sysfs attribute. A local user could write a negative value, which would be converted to an extremely large positive number and sent to the system management unit, incorrectly setting nonsensical multi-gigawatt socket power limits instead of being rejected.
Technical details
The vulnerability exists in the hsmp_hwmon_write() function in drivers/platform/x86/amd/hsmp/hwmon.c. The function accepts a signed long value from userspace and directly divides it by MICROWATT_PER_MILLIWATT (an unsigned long) before storing the result in a __u32. When a negative value is written, integer promotion causes it to be treated as a very large unsigned value, resulting in an incorrect power limit being sent via the HSMP_SET_SOCKET_POWER_LIMIT command to the SMU. The fix adds a simple check to reject negative values with -EINVAL before the division. This is a local hwmon interface issue that does not require special privileges beyond write access to the sysfs attribute.
Affected products
- Linux Linux kernel affected versions with HSMP hwmon support
Timeline
- 2026-09-17: disclosed: CVE-2026-90136 published
- 2026-09-14: patched: Fix committed to stable kernel trees
- 2026-08-12: other: Patch authored by Hemanth Selam