{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  HID: amd_sfh: Validate PCI BAR size before mapping  The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.  For example, a page fault can occur when reading from privdata-\u003emmio + AMD_P2C_MSG3 in mp2_select_ops():    BUG: unable to handle page fault for address: ffffc9000390368c   PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0   Oops: Oops: 0000 [#1] SMP KASAN NOPTI   RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]   RIP: 0010:mp2_select_ops drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:282   [inline]   RIP: 0010:amd_mp2_pci_probe+0x337/0x5f0   drivers/hid/amd-sfh-hid/amd_sfh_pcie.c:487   Call Trace:    \u003cTASK\u003e    local_pci_probe drivers/pci/pci-driver.c:332 [inline]    pci_call_probe drivers/pci/pci-driver.c:394 [inline]    __pci_device_probe drivers/pci/pci-driver.c:455 [inline]    pci_device_probe+0x431/0xc90 drivers/pci/pci-driver.c:489  Fix this by verifying that the length of BAR 2 is at least 128KB before attempting to map it. Since the maximum accessed offset is 0x10958, and PCI BAR sizes are powers of 2, any legitimate hardware will have a BAR size of at least 128KB.",
  "id": "DEBIAN-CVE-2026-98640",
  "modified": "2026-10-19T04:47:35.060809378Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98640"
    }
  ],
  "upstream": [
    "CVE-2026-98640"
  ]
}