CVE-2026-90136

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/hsmp: Reject negative power cap writes in hwmon

hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long

and assigns "val / MICROWATT_PER_MILLIWATT" to msg.args[0], which is a

__u32. MICROWATT_PER_MILLIWATT is an unsigned long, so a negative write

to power1_cap (e.g. "echo -1 > power1_cap") is first converted to a huge

unsigned value by the division and then stored into the u32 argument.

As a result a nonsensical, multi-gigawatt socket power limit is sent to

the SMU via HSMP_SET_SOCKET_POWER_LIMIT instead of the write being

rejected.

Reject negative values with -EINVAL before the conversion.

Tested with HSMP enabled:

CAP=$(dirname $(grep -l amd_hsmp_hwmon \

/sys/class/hwmon/hwmon*/name | head -1))/power1_cap

# negative write

echo -1000000 > $CAP ; echo "ret=$?"

# valid positive write must still work

echo 400000000 > $CAP ; echo "ret=$?"

Before:

# echo -100000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References