Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON units

Impact

On Intel Sapphire Rapids and Emerald Rapids hosts - the CPUs under most current GPU nodes - uncore_device_to_die() returns -1 when every CPU behind a UBOX device is offline, and pcibus_to_node() returns NUMA_NO_NODE when NUMA is disabled on a NUMA-capable platform. The first case trips WARN_ON_ONCE and breaks out of a scan that pci_get_device does not order, so further UBOX devices are silently skipped; the second makes spr_update_device_location drop the PMON units entirely. The operator-visible result is missing uncore counters - memory bandwidth, UPI, home agent - in host telemetry, and a panic on a kernel booted with panic_on_warn. NVD rates it 5.5, local availability only. This is not a privilege boundary crossing.

Who can reach it

No remote path. The condition is reached by a local user with the privilege to offline CPUs, or simply by booting the platform with NUMA disabled - the CVSS vector requires local access with low privileges.

What to do

Take a stable kernel containing the linked commits and reboot the node to pick it up; drain GPU workloads first as with any kernel update. Not worth its own maintenance window unless you rely on SPR/EMR uncore counters for capacity or fabric telemetry, or you boot production kernels with panic_on_warn - in either case the missing PMON units or the panic are the symptom you are fixing.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-43444 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel (drivers/pci): A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak isCVE-2026-45880 · Linux kernel (drivers/pci)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): Memory is handed to a consumer without beingCVE-2026-46229 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• polkit: unbounded stdin read in polkit-agent-helper-1 lets a local user exhaust system memoryCVE-2026-4897 · polkit polkit-agent-helper-1 (unbounded read from stdin in the setuid helper)Medium
• Linux kernel RDS connection info (uninitialised per-item buffer copied to userspace): The connection-info walkers handCVE-2026-52995 · Linux kernel RDS connection info (uninitialised per-item buffer copied to userspace)Medium
• Linux drm/xe GPU kernel driver (suspend/shutdown without display): The xe driver oopses on suspend or shutdownCVE-2026-53142 · Linux drm/xe GPU kernel driver (suspend/shutdown without display)Medium