The amd_sfh driver in the Linux kernel maps PCI BAR 2 without verifying that its size is large enough to support reads and writes up to offset 0x10958. If the driver is bound to a device whose BAR 2 is smaller than the required 128 KB, the driver performs an out‑of‑bounds memory access during probe, causing a page fault and a kernel "Oops." This leads to a kernel panic rather than arbitrary code execution, and consequently disrupts system availability.

All Linux systems that ship the amd_sfh HID driver and that attach to an AMD SFH device with a PCI BAR 2 size smaller than 128 KB are affected. Since no specific kernel version list is provided, any unpatched kernel that includes this driver and loads the device is potentially vulnerable.

A CVSS score of 4.4 and an EPSS score less than 1 % indicate a moderate quantitative risk for exploitation. The issue is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability is triggered when the amd_sfh driver is bound to a device with a PCI BAR 2 that is smaller than the required 128 KB. The likely attack vector therefore involves presenting or tampering with a PCI device to force the driver to probe a mis‑sized BAR, which would lead to an out‑of‑bounds memory access, a page fault and a kernel panic. This attack would require physical or privileged access to the device or to the PCI configuration space and would primarily affect availability; there is no known path to remote code execution.