Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON units

Impact

On Intel Sapphire Rapids and Emerald Rapids hosts - the CPUs under most current GPU nodes - uncore_device_to_die() returns -1 when every CPU behind a UBOX device is offline, and pcibus_to_node() returns NUMA_NO_NODE when NUMA is disabled on a NUMA-capable platform. The first case trips WARN_ON_ONCE and breaks out of a scan that pci_get_device does not order, so further UBOX devices are silently skipped; the second makes spr_update_device_location drop the PMON units entirely. The operator-visible result is missing uncore counters - memory bandwidth, UPI, home agent - in host telemetry, and a panic on a kernel booted with panic_on_warn. NVD rates it 5.5, local availability only. This is not a privilege boundary crossing.

Who can reach it

No remote path. The condition is reached by a local user with the privilege to offline CPUs, or simply by booting the platform with NUMA disabled - the CVSS vector requires local access with low privileges.

What to do

Take a stable kernel containing the linked commits and reboot the node to pick it up; drain GPU workloads first as with any kernel update. Not worth its own maintenance window unless you rely on SPR/EMR uncore counters for capacity or fabric telemetry, or you boot production kernels with panic_on_warn - in either case the missing PMON units or the panic are the symptom you are fixing.

References

Related entries

• Linux kernel KVM arm64: failed vGIC creation leaves redistributor regions uninitialised for teardownCVE-2026-43351 · Linux kernel KVM arm64 vGIC (dist/redist initialisation on create failure)Medium
• Linux kernel CephFS client: leaked path buffers on error paths exhaust kernel memoryCVE-2026-43419 · Linux kernel CephFS client (ceph_mdsc_build_path error paths)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-43444 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel KVM on AMD: stale CR8 write intercept after AVIC activation desynchronises guest TPRCVE-2026-43483 · Linux kernel KVM/SVM (CR8 write interception vs AVIC activation)Medium
• Linux kernel BPF cgroup storage: bogus pointer read and key copied to userspace at end of listCVE-2026-45838 · Linux kernel BPF (cgroup_storage_get_next_key() end-of-list detection)Medium
• Linux kernel SUNRPC auth_gss: kernel memory leaks on GSS-proxy XDR decode error pathsCVE-2026-45870 · Linux kernel SUNRPC auth_gss (gssx_dec_ctx / gssx_dec_status / gssx_dec_name XDR decode)Medium