CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved:

HID: amd sfh: Validate PCI BAR size before mapping

The amd sfh driver maps PCI BAR 2 using pcim iomap regions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMD P2C MSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.

For example, a page fault can occur when reading from privdata->mmio + AMD P2C MSG3 in mp2 select ops():

BUG: unable to handle page fault for address: ffffc9000390368c PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:mp2 select ops drivers/hid/amd-sfh-hid/amd sfh pcie.c:282 [inline] RIP: 0010:amd mp2 pci probe+0x337/0x5f0 drivers/hid/amd-sfh-hid/amd sfh pcie.c:487 Call Trace: local pci probe drivers/pci/pci-driver.c:332 [inline] pci call probe drivers/pci/pci-driver.c:394 [inline] pci device probe drivers/pci/pci-driver.c:455 [inline] pci device probe+0x431/0xc90 drivers/pci/pci-driver.c:489

Fix this by verifying that the length of BAR 2 is at least 128KB before attempting to map it. Since the maximum accessed offset is 0x10958, and PCI BAR sizes are powers of 2, any legitimate hardware will have a BAR size of at least 128KB.