CVE-2026-81016 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
An attacker with local access could trigger a kernel warning and potential denial of service by causing the AMD PMC driver to map physical address zero due to unchecked SMU errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81016?
CVE-2026-81016 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
amd_stb_s2d_init() discards the return value of several S2D SMU commands. When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the failure is only noticed indirectly - if at all - and reported as -EIO, masking the real error.
More seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so on failure phys_addr_low/hi are left uninitialised and the assembled address is passed straight to devm_ioremap(). When the SMU leaves them at zero this maps physical address 0 and trips the ioremap-on-RAM warning:
amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:...
Check the return value of each SMU command and propagate it, and reject a zero physical address before calling devm_ioremap().
Which versions are affected by CVE-2026-81016?
How do I fix CVE-2026-81016?
Apply the vendor's patch.
Is CVE-2026-81016 being exploited?
There is no known exploitation of CVE-2026-81016 in the wild and no public exploit code.
Sources
Also known as AZL-100124, BELL-CVE-2026-81016, DEBIAN-CVE-2026-81016, GHSA-wv8r-9hh3-p28x, UBUNTU-CVE-2026-81016.