{"id":"CVE-2021-26372","aliases":["EUVD-2021-13178","GHSA-x5hg-q2vc-mxfh","SUSE-SU-2022:1751-1","SUSE-SU-2022:1840-1","SUSE-SU-2022:1846-1","SUSE-SU-2022:1847-1","SUSE-SU-2022:1923-1"],"status":"published","title":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in...","description":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0022,"percentile":0.12708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2022-05-11T16:18:58Z","modified":"2026-06-17T03:43:15Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200107-150100.3.31.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210208-150300.4.10.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210208-150300.4.10.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210208-150300.4.10.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210208-150300.4.10.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.25.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.25.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.25.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.25.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.25.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190618-5.25.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191118-150000.3.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191118-150000.3.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191118-150000.3.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191118-150000.3.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220509-150400.4.5.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220509-150400.4.5.1"}]}],"bundled":17}],"products":[{"vendor":"amd","product":"athlon™ series"},{"vendor":"amd","product":"epyc_7232p_firmware"},{"vendor":"amd","product":"epyc_7252_firmware"},{"vendor":"amd","product":"epyc_7262_firmware"},{"vendor":"amd","product":"epyc_7272_firmware"},{"vendor":"amd","product":"epyc_7282_firmware"},{"vendor":"amd","product":"epyc_72f3_firmware"},{"vendor":"amd","product":"epyc_7302_firmware"},{"vendor":"amd","product":"epyc_7302p_firmware"},{"vendor":"amd","product":"epyc_7313p_firmware"},{"vendor":"amd","product":"epyc_7343_firmware"},{"vendor":"amd","product":"epyc_7352_firmware"},{"vendor":"amd","product":"epyc_7373x_firmware"},{"vendor":"amd","product":"epyc_73f3_firmware"},{"vendor":"amd","product":"epyc_7402_firmware"},{"vendor":"amd","product":"epyc_7402p_firmware"},{"vendor":"amd","product":"epyc_7413_firmware"},{"vendor":"amd","product":"epyc_7443p_firmware"},{"vendor":"amd","product":"epyc_7452_firmware"},{"vendor":"amd","product":"epyc_7453_firmware"},{"vendor":"amd","product":"epyc_7473x_firmware"},{"vendor":"amd","product":"epyc_74f3_firmware"},{"vendor":"amd","product":"epyc_7502_firmware"},{"vendor":"amd","product":"epyc_7502p_firmware"},{"vendor":"amd","product":"epyc_7513_firmware"},{"vendor":"amd","product":"epyc_7532_firmware"},{"vendor":"amd","product":"epyc_7542_firmware"},{"vendor":"amd","product":"epyc_7543p_firmware"},{"vendor":"amd","product":"epyc_7552_firmware"},{"vendor":"amd","product":"epyc_7573x_firmware"},{"vendor":"amd","product":"epyc_75f3_firmware"},{"vendor":"amd","product":"epyc_7642_firmware"},{"vendor":"amd","product":"epyc_7643_firmware"},{"vendor":"amd","product":"epyc_7662_firmware"},{"vendor":"amd","product":"epyc_7663_firmware"},{"vendor":"amd","product":"epyc_7702_firmware"},{"vendor":"amd","product":"epyc_7702p_firmware"},{"vendor":"amd","product":"epyc_7713_firmware"},{"vendor":"amd","product":"epyc_7713p_firmware"},{"vendor":"amd","product":"epyc_7742_firmware"},{"vendor":"amd","product":"epyc_7763_firmware"},{"vendor":"amd","product":"epyc_7773x_firmware"},{"vendor":"amd","product":"epyc_7f32_firmware"},{"vendor":"amd","product":"epyc_7f52_firmware"},{"vendor":"amd","product":"epyc_7f72_firmware"},{"vendor":"amd","product":"epyc™ processors"},{"vendor":"amd","product":"ryzen™ series"}],"references":[{"url":"https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26372"},{"url":"https://github.com/advisories/GHSA-x5hg-q2vc-mxfh"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221751-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192953","tags":["report"]},{"url":"https://bugzilla.suse.com/1195786","tags":["report"]},{"url":"https://bugzilla.suse.com/1199459","tags":["report"]},{"url":"https://bugzilla.suse.com/1199470","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46744","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221840-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221846-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221847-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221923-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-26372","description":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.","status":"published","published":"2022-05-11T16:18:58.798Z","modified":"2024-09-16T19:15:19.878Z","updated_at":"2026-11-02T14:32:57.033395Z"}],"euvd":[{"id":"EUVD-2021-13178","description":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.","status":"published","published":"2022-05-11T16:18:58Z","modified":"2024-09-16T19:15:19Z","updated_at":"2026-11-03T00:55:24.732716Z"}],"ghsa":[{"id":"GHSA-x5hg-q2vc-mxfh","title":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in...","description":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.","status":"published","published":"2022-05-12T00:01:28Z","modified":"2023-02-01T05:02:15Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:49:52.829666Z"}],"nvd":[{"id":"CVE-2021-26372","description":"Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.","status":"published","published":"2022-05-11T17:15:08.547Z","modified":"2026-06-17T03:43:15.737Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:06.029737Z"}],"osv":[{"id":"SUSE-SU-2022:1751-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\nUpdate AMD ucode and SEV firmware\n\n- CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376,\n  CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339,\n  CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,\n  CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744,\n  bsc#1199459, bsc#1199470)\n\nUpdate Intel Bluetooth firmware (INTEL-SA-00604, bsc#1195786):\n\n- CVE-2021-33139, CVE-2021-33155: Improper conditions check in the firmware for some Intel Wireless Bluetooth and Killer Bluetooth products may allow an authenticated user to potentially cause denial of service via adjacent access.\n","status":"published","published":"2022-05-19T13:31:41Z","modified":"2026-02-04T03:29:01.090024Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1840-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\nUpdate AMD ucode and SEV firmware\n- (CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376,\n  CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339,\n  CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,\n  CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744,\n  bsc#1199459, bsc#1199470)\n","status":"published","published":"2022-05-25T09:53:53Z","modified":"2026-02-04T03:08:05.850722Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1846-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\nUpdate AMD ucode and SEV firmware\n\n- (CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376,\n   CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339,\n   CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,\n   CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744,\n   bsc#1199459, bsc#1199470)\n","status":"published","published":"2022-05-25T14:34:28Z","modified":"2025-05-02T04:31:15.607705Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1847-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\nUpdate AMD ucode and SEV firmware\n\n- (CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376,\n   CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339,\n   CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,\n   CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744,\n   bsc#1199459, bsc#1199470)\n","status":"published","published":"2022-05-25T15:11:41Z","modified":"2026-02-04T02:22:47.822886Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1923-1","title":"Security update for kernel-firmware","description":"This update for kernel-firmware fixes the following issues:\n\nUpdate to version 20220411 (git commit f219d616f42b, bsc#1199459):\n    \n- CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26350,\n  CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339,\n  CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,\n  CVE-2021-26364, CVE-2021-26312: Update AMD cpu microcode\n\n    \nUpdate to version 20220309 (git commit cd01f857da28, bsc#1199470):\n\n- CVE-2021-46744: Ciphertext Side Channels on AMD SEV\n\n    \nUpdate Intel Bluetooth firmware (INTEL-SA-00604, bsc#1195786):\n\n- CVE-2021-33139, CVE-2021-33155: Improper conditions check in the firmware for some Intel Wireless Bluetooth and Killer Bluetooth products may allow an authenticated user to potentially cause denial of service via adjacent access.\n","status":"published","published":"2022-06-02T12:04:09Z","modified":"2026-02-04T03:52:17.832387Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}