CVE-2026-81016

This flaw, classified as CWE-908, involves improper handling of SMU command return values and uninitialized address usage, leading to potential kernel instability. The flaw resides in the Linux kernel’s AMD Performance Monitoring Counters (PMC) driver for x86 CPUs. During initialization, the function amd_stb_s2d_init() discards the return values of several System Management Unit (SMU) commands, masking real failures as a generic I/O error. Even more critically, the low and high physical address values produced by the SMU are ignored when a command fails, leaving the address uninitialized. If the SMU returns zeros, the driver passes this uninitialized address to devm_ioremap(), which attempts to map physical address 0. This produces an ioremap‑on‑RAM warning and can lead to undefined kernel behavior or instability.

The issue affects the Linux kernel’s AMD PMC driver on x86 platforms. The CPE string indicates a general Linux kernel; no specific kernel versions are listed in the data, so the affected release range is unknown.

The CVSS base score of 7.7 indicates high severity, while the EPSS score of <1% shows a low estimated probability of exploitation. The flaw requires kernel‑mode execution; based on the description, it is inferred that an attacker would need local privileged access or the ability to load a malicious kernel module to trigger the vulnerable path. The likely attack vector is an attacker with local privileged access exploiting the AMD PMC driver, either by injecting a crafted kernel module or compromising kernel space. Because the SMU error is masked as a generic I/O failure, exploitation may be difficult and it is not currently catalogued in CISA’s KEV list.