FKIE_CVE-2026-92505

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devid_write debugfs function When for_each_pci_segment() loop completes without finding a matching segment, the pci_seg pointer is not NULL but points to an invalid memory location (the list head). Accessing pci_seg->id after the loop causes undefined behavior. Fix this by handling the successful case inside the loop and returning -EINVAL after the loop if no matching segment is found.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/843e149989665f8309ad2efe6048dc76591e1f94
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8aabe0fba01486b5d893e708b05a8fa7f1b7efbb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/99d42aef089a07cfb1d404a7227ac9dc7628b497
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8aabe0fba01486b5d893e708b05a8fa7f1b7efbb",
              "status": "affected",
              "version": "2e98940f123d9c69d4759078aea9a536244c98d3",
              "versionType": "git"
            },
            {
              "lessThan": "99d42aef089a07cfb1d404a7227ac9dc7628b497",
              "status": "affected",
              "version": "2e98940f123d9c69d4759078aea9a536244c98d3",
              "versionType": "git"
            },
            {
              "lessThan": "843e149989665f8309ad2efe6048dc76591e1f94",
              "status": "affected",
              "version": "2e98940f123d9c69d4759078aea9a536244c98d3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix undefined behavior in devid_write debugfs function\n\nWhen for_each_pci_segment() loop completes without finding a matching\nsegment, the pci_seg pointer is not NULL but points to an invalid memory\nlocation (the list head). Accessing pci_seg-\u003eid after the loop causes\nundefined behavior.\n\nFix this by handling the successful case inside the loop and returning\n-EINVAL after the loop if no matching segment is found."
    }
  ],
  "id": "CVE-2026-92505",
  "lastModified": "2026-09-17T17:17:53.077",
  "metrics": {},
  "published": "2026-09-17T17:17:53.077",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/843e149989665f8309ad2efe6048dc76591e1f94"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8aabe0fba01486b5d893e708b05a8fa7f1b7efbb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/99d42aef089a07cfb1d404a7227ac9dc7628b497"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.