CVE-2021-26376 json
Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of reso…
published 2022-05-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-13182
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service.
Patch / fix
- amd epyc_7232p_firmware romepi-sp3_1.0.0.d
- amd epyc_7302p_firmware romepi-sp3_1.0.0.d
- amd epyc_7402p_firmware romepi-sp3_1.0.0.d
- amd epyc_7502p_firmware romepi-sp3_1.0.0.d
- amd epyc_7702p_firmware romepi-sp3_1.0.0.d
- amd epyc_7252_firmware romepi-sp3_1.0.0.d
- amd epyc_7262_firmware romepi-sp3_1.0.0.d
- amd epyc_7272_firmware romepi-sp3_1.0.0.d
- amd epyc_7282_firmware romepi-sp3_1.0.0.d
- amd epyc_7302_firmware romepi-sp3_1.0.0.d
- amd epyc_7352_firmware romepi-sp3_1.0.0.d
- amd epyc_7402_firmware romepi-sp3_1.0.0.d
- amd epyc_7452_firmware romepi-sp3_1.0.0.d
- amd epyc_7502_firmware romepi-sp3_1.0.0.d
- amd epyc_7532_firmware romepi-sp3_1.0.0.d
- amd epyc_7542_firmware romepi-sp3_1.0.0.d
- amd epyc_7552_firmware romepi-sp3_1.0.0.d
- amd epyc_7642_firmware romepi-sp3_1.0.0.d
- amd epyc_7662_firmware romepi-sp3_1.0.0.d
- amd epyc_7702_firmware romepi-sp3_1.0.0.d
- kernel-firmware SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 20220509-150400.4.5.1
- kernel-firmware SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 20191118-150000.3.42.1
- kernel-firmware SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 20190618-5.25.2
- kernel-firmware SLE Module for Basesystem 15 SP3, SLE Micro 5.2, SLE Micro 5.1 +1 more 20210208-150300.4.10.1
- kernel-firmware SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +12 more 20200107-150100.3.31.1
suse advisories SUSE-SU-2022:1923-1SUSE-SU-2022:1847-1SUSE-SU-2022:1846-1SUSE-SU-2022:1840-1SUSE-SU-2022:1751-1
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- AMD EPYC™ Processors
- AMD Ryzen™ Series
- AMD Athlon™ Series
References
-
amd.com
/en/corporate/product-security/bulletin/amd-sb-1027
vendor-advisory
-
amd.com
/en/corporate/product-security/bulletin/amd-sb-1028
vendor-advisory
Sources
- CVE List CVE-2021-26376
- NVD CVE-2021-26376
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.