CVE-2021-26375 json
Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address sp…
published 2022-05-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-13181
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.
Patch / fix
- amd epyc_7232p_firmware romepi-sp3_1.0.0.d
- amd epyc_7302p_firmware romepi-sp3_1.0.0.d
- amd epyc_7402p_firmware romepi-sp3_1.0.0.d
- amd epyc_7502p_firmware romepi-sp3_1.0.0.d
- amd epyc_7702p_firmware romepi-sp3_1.0.0.d
- amd epyc_7252_firmware romepi-sp3_1.0.0.d
- amd epyc_7262_firmware romepi-sp3_1.0.0.d
- amd epyc_7272_firmware romepi-sp3_1.0.0.d
- amd epyc_7282_firmware romepi-sp3_1.0.0.d
- amd epyc_7302_firmware romepi-sp3_1.0.0.d
- amd epyc_7352_firmware romepi-sp3_1.0.0.d
- amd epyc_7402_firmware romepi-sp3_1.0.0.d
- amd epyc_7452_firmware romepi-sp3_1.0.0.d
- amd epyc_7502_firmware romepi-sp3_1.0.0.d
- amd epyc_7532_firmware romepi-sp3_1.0.0.d
- amd epyc_7542_firmware romepi-sp3_1.0.0.d
- amd epyc_7552_firmware romepi-sp3_1.0.0.d
- amd epyc_7642_firmware romepi-sp3_1.0.0.d
- amd epyc_7662_firmware romepi-sp3_1.0.0.d
- amd epyc_7702_firmware romepi-sp3_1.0.0.d
- kernel-firmware SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 20220509-150400.4.5.1
- kernel-firmware SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 20191118-150000.3.42.1
- kernel-firmware SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 20190618-5.25.2
- kernel-firmware SLE Module for Basesystem 15 SP3, SLE Micro 5.2, SLE Micro 5.1 +1 more 20210208-150300.4.10.1
- kernel-firmware SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +12 more 20200107-150100.3.31.1
suse advisories SUSE-SU-2022:1923-1SUSE-SU-2022:1847-1SUSE-SU-2022:1846-1SUSE-SU-2022:1840-1SUSE-SU-2022:1751-1
- kernel-firmware-all openSUSE Tumbleweed 20250206-1.1
- kernel-firmware-amdgpu openSUSE Tumbleweed 20250206-1.1
- kernel-firmware-ath10k openSUSE Tumbleweed 20250206-1.1
- kernel-firmware-ath11k openSUSE Tumbleweed 20250206-1.1
- kernel-firmware-ath12k openSUSE Tumbleweed 20250206-1.1
- kernel-firmware-atheros openSUSE Tumbleweed 20250206-1.1
- kernel-firmware-bluetooth openSUSE Tumbleweed 20250208-1.1
- kernel-firmware-bnx2 openSUSE Tumbleweed 20250206-1.1
opensuse advisories openSUSE-SU-2025:14804-1openSUSE-SU-2025:14769-1openSUSE-SU-2025:14770-1openSUSE-SU-2025:14771-1openSUSE-SU-2025:14772-1openSUSE-SU-2025:14773-1
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- AMD EPYC™ Processors
- AMD Ryzen™ Series
- AMD Athlon™ Series
References
-
amd.com
/en/corporate/product-security/bulletin/amd-sb-1027
vendor-advisory
-
amd.com
/en/corporate/product-security/bulletin/amd-sb-1028
vendor-advisory
Sources
- CVE List CVE-2021-26375
- NVD CVE-2021-26375
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.