The amd_sfh driver in the Linux kernel maps PCI BAR 2 without first confirming that its size is large enough to support reads and writes up to offset 0x10958. If the driver is bound to a device whose BAR 2 is smaller than the required 128 KB, the driver performs an out‑of‑bounds memory access during probe, causing a page fault and a kernel "Oops." This leads to a kernel panic rather than arbitrary code execution, and consequently disrupts system availability.

All Linux systems that ship the amd_sfh HID driver and that attach to an AMD SFH device with a PCI BAR 2 size smaller than 128 KB are affected. Since no specific kernel version list is provided, any unpatched kernel that includes this driver and loads the device is potentially vulnerable.

A CVSS score is not supplied and the EPSS score is unavailable, so quantitative risk is indeterminate. The issue is not listed in the CISA KEV catalog. The vulnerability can be triggered by any device that the kernel associates with the amd_sfh driver, meaning a local attacker who can introduce or manipulate the hardware could force a kernel panic. The impact is limited to availability; exploitation requires control over the device or its PCI configuration and would most likely require physical access or the ability to force the device to be probed.