CVE-2026-81016: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-81016 Overview

CVE-2026-81016 is a Linux kernel vulnerability in the AMD Platform Management Controller (PMC) driver at platform/x86/amd/pmc. The function amd_stb_s2d_init() discards return values from several Store-to-DRAM (S2D) System Management Unit (SMU) commands. When the SMU rejects a command, the failure surfaces only indirectly as -EIO, masking the real error condition.

More critically, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored. On failure, phys_addr_low/hi remain uninitialised and the assembled address is passed directly to devm_ioremap(), which can map physical address zero and trip the ioremap-on-RAM warning.

Critical Impact
Local attackers or faulty firmware conditions can trigger an uninitialised-memory ioremap on RAM, producing kernel warnings and potential system instability on affected AMD platforms.

Affected Products

Linux kernel platform/x86/amd/pmc driver on AMD systems supporting S2D SMU commands
Kernel branches prior to the fixes in commits 0225c1d, 775d4cde, and 8178f59d
Distributions shipping vulnerable stable kernel versions until backports are applied

Discovery Timeline

2026-09-11 - CVE-2026-81016 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-81016

Vulnerability Analysis

The vulnerability resides in the AMD PMC driver's amd_stb_s2d_init() initialization path. The driver issues several SMU commands to obtain the physical address of the S2D buffer but never checks the return codes from those commands. When the SMU responds with an error such as SMU cmd failed. err: 0xff, the driver continues execution as if the values had been populated correctly.

The consequence is twofold. First, upstream callers receive a generic -EIO that obscures the actual SMU failure, hindering diagnostics. Second, the low and high halves of the physical address remain uninitialised on the stack or in driver state. The driver then assembles these into a single address and passes it to devm_ioremap(). If the SMU leaves the values at zero, the driver attempts to ioremap physical address 0x0, which overlaps normal system RAM.

Mapping RAM through ioremap triggers a kernel WARNING at arch/x86/mm/ioremap.c, taints the kernel, and leaves the driver in an inconsistent state. Local users on affected systems can observe this warning during boot or driver load. This class of issue falls under uninitialised memory use combined with missing input validation on values returned from a hardware interface.

Root Cause

The root cause is missing error propagation. amd_stb_s2d_init() invokes SMU commands, including S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH, without capturing or validating their return codes. No sanity check rejects a zero physical address before it reaches devm_ioremap().

Attack Vector

Exploitation requires local access to a system running an affected AMD PMC driver. An attacker cannot directly control SMU responses from userspace, but any condition that causes the SMU to reject the S2D initialization commands, including firmware bugs, power state transitions, or malformed platform configuration, will trigger the flawed code path. The result is a kernel warning and potential availability impact rather than direct code execution.

No verified public exploit code is available. The upstream fixes in commits 0225c1d, 775d4cde, and 8178f59d add return-value checks on each SMU command and reject a zero physical address before calling devm_ioremap().

Detection Methods for CVE-2026-81016

Indicators of Compromise

Kernel log entries containing amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff during boot or driver load.
Warning messages of the form ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff in dmesg.
Kernel taint flags set after the WARNING: CPU: N PID: N at arch/x86/mm/ioremap.c trace.

Detection Strategies

Parse dmesg and journal output for the amd_pmc SMU failure signature paired with an ioremap on RAM warning.
Inventory running kernels against the fixed commits to identify hosts still exposed on AMD hardware.
Correlate kernel WARNING traces with subsequent PMC or suspend-to-idle failures during platform testing.

Monitoring Recommendations

Forward kernel logs from AMD endpoints and servers to a centralized log platform for keyword alerting on amd_pmc and ioremap on RAM.
Track kernel taint state across the fleet and investigate hosts whose taint transitions during boot.
Include AMD PMC warnings in platform reliability dashboards to surface firmware regressions early.

How to Mitigate CVE-2026-81016

Immediate Actions Required

Update affected Linux kernels to a stable release that includes commits 0225c1d, 775d4cde, or 8178f59d.
Apply distribution kernel updates from your vendor as soon as backported fixes are available.
Audit AMD-based systems for repeated amd_pmc SMU failures and escalate for firmware review.

Patch Information

The fix propagates the return value of each SMU command in amd_stb_s2d_init() and rejects a zero physical address before calling devm_ioremap(). See the upstream commits 0225c1d, 775d4cde, and 8178f59d for the full patch content across supported stable branches.

Workarounds

Where the AMD PMC S2D functionality is not required, blacklist or unload the amd_pmc module to avoid triggering the vulnerable initialization path.
Update system firmware and BIOS to versions in which the SMU accepts the S2D commands, eliminating the failure condition.
Restrict local access to affected hosts and monitor for repeated driver initialization warnings until patches are deployed.

bash

# Verify running kernel and check for the vulnerable driver signature
uname -r
dmesg | grep -E 'amd_pmc|ioremap on RAM'

# Temporarily prevent the module from loading if the platform does not need it
echo 'blacklist amd_pmc' | sudo tee /etc/modprobe.d/disable-amd-pmc.conf
sudo update-initramfs -u