---
id: CVE-2026-90136
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86/amd/hsmp: Reject negative power cap writes in hwmon

  hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long
  and assigns "val / MICROWATT_P…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86/amd/hsmp: Reject negative power cap writes in hwmon

  hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long
  and assigns "val / MICROWATT_P…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 92c025db52bb94a032eb3d473bb81e62c19ddbd3 <
    2c09cadec116eba3fdbcb5d8d8641f6777d4a11f
  - >-
    Linux >= 92c025db52bb94a032eb3d473bb81e62c19ddbd3 <
    1b0a3d915320f1600e5ff43f8bc21b73118480b8
  - >-
    Linux >= 92c025db52bb94a032eb3d473bb81e62c19ddbd3 <
    3921bb8635ff2836622df1cdf3194d4f3c1835a4
  - Linux 6.16
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:06.173'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90136'
references:
  - url: 'https://git.kernel.org/stable/c/1b0a3d915320f1600e5ff43f8bc21b73118480b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c09cadec116eba3fdbcb5d8d8641f6777d4a11f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3921bb8635ff2836622df1cdf3194d4f3c1835a4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90136.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90136'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536329'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90136'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90136'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90136.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.879Z'
epss: 0.00206
epssPercentile: 0.10648
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-190
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/hsmp: Reject negative power cap writes in hwmon

hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long
and assigns "val / MICROWATT_PER_MILLIWATT" to msg.args[0], which is a
__u32.  MICROWATT_PER_MILLIWATT is an unsigned long, so a negative write
to power1_cap (e.g. "echo -1 > power1_cap") is first converted to a huge
unsigned value by the division and then stored into the u32 argument.

As a result a nonsensical, multi-gigawatt socket power limit is sent to
the SMU via HSMP_SET_SOCKET_POWER_LIMIT instead of the write being
rejected.

Reject negative values with -EINVAL before the conversion.

Tested with HSMP enabled:

  CAP=$(dirname $(grep -l amd_hsmp_hwmon \
        /sys/class/hwmon/hwmon*/name | head -1))/power1_cap

  # negative write
  echo -1000000 > $CAP ; echo "ret=$?"
  # valid positive write must still work
  echo 400000000 > $CAP ; echo "ret=$?"

Before:
  # echo -1000000 > $CAP ; echo "ret=$?"
  ret=0                             <- accepted; bogus limit sent to SMU
  # echo 400000000 > $CAP ; echo "ret=$?"
  ret=0

After:
  # echo -1000000 > $CAP ; echo "ret=$?"
  bash: echo: write error: Invalid argument
  ret=1                             <- rejected with -EINVAL
  # echo 400000000 > $CAP ; echo "ret=$?"
  ret=0                             <- valid write still works

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90136.json)