CVE-2026-98640: Linux Kernel HID Buffer Overflow Vulnerability

CVE-2026-98640 Overview

CVE-2026-98640 is a Linux kernel vulnerability in the amd_sfh HID driver for AMD Sensor Fusion Hub devices. The driver maps PCI Base Address Register (BAR) 2 using pcim_iomap_regions() and then accesses memory-mapped I/O (MMIO) registers at offsets up to 0x10958. The driver does not validate that the BAR is large enough to cover these accesses. When bound to a device with a smaller BAR 2, the probe path triggers an out-of-bounds read and a page fault in mp2_select_ops(), crashing the kernel.

Critical Impact
An unvalidated BAR size causes an out-of-bounds MMIO read during driver probe, resulting in a kernel page fault and denial of service on affected AMD platforms.

Affected Products

Linux kernel builds containing the amd_sfh HID driver (drivers/hid/amd-sfh-hid/amd_sfh_pcie.c)
Systems using AMD Sensor Fusion Hub PCI devices bound to the driver
Distributions shipping vulnerable kernel versions prior to the stable backports referenced in the upstream fix commits

Discovery Timeline

2026-10-18 - CVE-2026-98640 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98640

Vulnerability Analysis

The amd_sfh driver is responsible for interfacing with the AMD Sensor Fusion Hub (SFH), which exposes HID sensors over PCI. During probe, the driver calls pcim_iomap_regions() to map PCI BAR 2 and later issues readl() operations against offsets as large as AMD_P2C_MSG3 at 0x1068C.

Because the driver omits a sanity check on the mapped region length, a device presenting a smaller BAR 2 causes the dereference to land outside the mapped virtual range. The kernel log shows the fault at readl inside mp2_select_ops() called from amd_mp2_pci_probe(), with the trace continuing into pci_device_probe().

The upstream fix verifies that BAR 2 is at least 128KB before mapping. Since PCI BAR sizes are powers of two and the maximum accessed offset is 0x10958, 128KB is the minimum legitimate size.

Root Cause

The root cause is missing input validation on hardware-reported resource sizing [CWE-125 class, Out-of-Bounds Read]. The driver assumes the device-provided BAR 2 is large enough for all MMIO accesses the driver will perform. No call to pci_resource_len() gated the subsequent register reads, so a non-conforming or spoofed device can satisfy the probe match while providing an undersized region.

Attack Vector

Exploitation requires a PCI device whose vendor and device identifiers match the driver's bind table but which exposes a BAR 2 smaller than 128KB. In practice this is a local attack surface: a malicious or misconfigured PCI device, a virtualized guest with a crafted emulated device model, or faulty hardware can trigger the fault. The result is a kernel oops during probe, producing a denial of service rather than code execution.

No verified public exploit code is available. Refer to the upstream fix commits for the authoritative patch, such as Kernel Git Commit 5f9e2ec and Kernel Git Commit ee25833.

Detection Methods for CVE-2026-98640

Indicators of Compromise

Kernel oops entries referencing amd_mp2_pci_probe and mp2_select_ops in drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
BUG: unable to handle page fault for address messages involving readl from arch/x86/include/asm/io.h
Repeated probe failures or crashes immediately after PCI enumeration of an AMD SFH device

Detection Strategies

Correlate dmesg output for page-fault traces that originate in local_pci_probe and terminate inside the amd_sfh module
Monitor host or guest kernels for crashes tied to attachment of PCI vendor/device IDs claimed by amd_sfh
In virtualized environments, inspect guest-exposed PCI device models for BAR 2 sizes below 128KB that match the AMD SFH binding

Monitoring Recommendations

Centralize kernel log ingestion and alert on Oops events referencing HID or amd_sfh call stacks
Track kernel package versions across the fleet and flag hosts running unpatched builds predating the referenced stable commits
Review hypervisor configurations that permit arbitrary PCI passthrough or emulated device creation by unprivileged tenants

How to Mitigate CVE-2026-98640

Immediate Actions Required

Apply the vendor-provided stable kernel update that includes the amd_sfh BAR size validation
Reboot affected systems after upgrading to load the patched kernel
On systems that do not require AMD Sensor Fusion Hub functionality, blacklist the amd_sfh module until patched

Patch Information

The fix adds a check that BAR 2 is at least 128KB before mapping, preventing the out-of-bounds readl() in mp2_select_ops(). The change is distributed across multiple stable branches via commits 5f9e2ec, 5ff24aa, 65bcc5f, 7b3747d, 92bf288, dc68748, and ee25833.

Workarounds

Prevent the driver from loading on hosts where AMD SFH is unused by adding blacklist amd_sfh to a modprobe configuration file
Restrict PCI passthrough and emulated-device creation to trusted administrators in virtualized environments
Avoid binding amd_sfh to devices whose BAR 2 size cannot be verified as at least 128KB

bash

# Configuration example
# Disable the vulnerable driver until the kernel is patched
echo 'blacklist amd_sfh' | sudo tee /etc/modprobe.d/disable-amd-sfh.conf
sudo rmmod amd_sfh 2>/dev/null || true
sudo update-initramfs -u