CVE-2026-97946x86/amd_node: Fix PCI device reference counting in amd_smn_init()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix PCI device reference counting in amd_smn_init() The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the search is complete. Use the __free() cleanup macro to ensure the refcount is decremented when the temporary pointer goes out of scope. Additionally, increment the refcount when caching a root pointer. This ensures the in-use refcount is separate from the temporary search refcounting. Finally, drop the redundant "root = NULL" before the second search loop. The pci_get_class() iterator always decrements the refcount of its "from" argument, so the first loop can only fall through with "root" already NULL.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb before 84e3a71d11d8593c127b468d75b2653af5074f81; from 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb before aa2a4277ad42fd8f918c6dc652473946a253f7b0; from 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb before 27600805e62f800bacf990354632eae4e487d34c; c4ad899a33198ab6335732c769835d035e66894a; from 6.17.8 before 6.18 | CNA record |
References
- https://git.kernel.org/stable/c/84e3a71d11d8593c127b468d75b2653af5074f81
- https://git.kernel.org/stable/c/aa2a4277ad42fd8f918c6dc652473946a253f7b0
- https://git.kernel.org/stable/c/27600805e62f800bacf990354632eae4e487d34c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.