CVE-2026-81016

CVE CVE-2026-81016EUVD EUVD-2026-76339Published 2026-09-11T19:43:04.000ZLast changed 2026-09-13T06:29:18.000ZCVSS 7.7

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amd_stb_s2d_init() discards the return value of several S2D SMU commands. When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the failure is only noticed indirectly - if at all - and reported as -EIO, masking the real error. More seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so on failure phys_addr_low/hi are left uninitialised and the assembled address is passed straight to devm_ioremap(). When the SMU leaves them at zero this maps physical address 0 and trips the ioremap-on-RAM warning: amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:... Check the return value of each SMU command and propagate it, and reject a zero physical address before calling devm_ioremap().

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d <775d4cde1f9737796ce7d8393521e9e8c5b49891; patch: 7.3-rc1; 5.18; 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d <8178f59d76570b152d836bde07f5997f15861f04; patch: 7.2.4; 3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d <0225c1d637687b03726f00ac65b6def843d2c464; patch: 0; patch: 6.18.50

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.