{"id":21349,"date":"2026-09-12T04:31:04","date_gmt":"2026-09-11T20:31:04","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81016"},"modified":"2026-09-12T04:31:04","modified_gmt":"2026-09-11T20:31:04","slug":"cve-2026-81016","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81016","title":{"rendered":"CVE-2026-81016 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nplatform\/x86\/amd\/pmc:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>platform\/x86\/amd\/pmc: Propagate SMU errors and validate S2D address<\/p>\n<p>amd_stb_s2d_init() discards the return value of several S2D SMU commands.<br \/>\nWhen the SMU refuses a command (e.g. &#8220;SMU cmd failed. err: 0xff&#8221;) the<br \/>\nfailure is only noticed indirectly &#8211; if at all &#8211; and reported as -EIO,<br \/>\nmasking the real error.<\/p>\n<p>More seriously, the S2D_PHYS_ADDR_LOW\/HIGH return values are ignored, so<br \/>\non failure phys_addr_low\/hi are left uninitialised and the assembled<br \/>\naddress is passed straight to devm_ioremap().  When the SMU leaves them at<br \/>\nzero this maps physical address 0 and trips the ioremap-on-RAM warning:<\/p>\n<p>  amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff<br \/>\n  ioremap on RAM at 0x0000000000000000 &#8211; 0x0000000000ffffff<br \/>\n  WARNING: CPU: 13 PID: 4592 at arch\/x86\/mm\/ioremap.c:&#8230;<\/p>\n<p>Check the return value of each SMU command and propagate it, and reject a<br \/>\nzero physical address before calling devm_ioremap().<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>platform\/x86\/amd\/pmc: Propagate SMU errors and validate S2D address<\/p>\n<p>amd_stb_s2d_init() discards the return value of several S2D SM<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21349","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}