CVE-2026-90136 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux kernel versions that are affected by this vulnerability should assess their exposure and apply patches or mitigations as necessary.

Why it matters

This vulnerability allows for potential exploitation of the Linux kernel's platform/x86/amd/hsmp component, resulting in nonsensical socket power limits being sent to the SMU. Linux kernel maintainers, Linux distribution vendors, and users of affected Linux kernel versions should assess their exposure and apply patches or mitigations as necessary.

• Verify Linux kernel versions and apply patches to prevent potential exploitation.
• Monitor system logs for potential exploitation attempts.
• Assess exposure and prioritize patching for Linux kernel versions that are affected by this vulnerability.

Technical summary

The Linux kernel's platform/x86/amd/hsmp component is vulnerable to a negative power cap write issue. When a negative value is written to power1_cap, it is converted to a huge unsigned value and stored in a u32 argument, resulting in a nonsensical, multi-gigawatt socket power limit being sent to the SMU. This issue has been fixed by rejecting negative values with -EINVAL before conversion. The fix involves modifying the hsmp_hwmon_write() function to validate user-supplied hwmon values before converting them to a __u32 argument.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers to ensure that the vulnerability is addressed.
• Verify that the Linux kernel version is within the unaffected range or has the applied patches.
• Monitor system logs for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. The Linux kernel maintainers have provided patches to address this vulnerability, which involve modifying the hsmp_hwmon_write() function to reject negative power cap writes. The patches have been tested and validated to ensure that they effectively prevent the exploitation of this vulnerability. The CVE record and source item also provide additional information on the vulnerability,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.