CVE-2026-46073: hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (powerz) Fix missing usbkillurb() on signal interrupt
waitforcompletioninterruptibletimeout() returns -ERESTARTSYS when interrupted. This needs to abort the URB and return an error. No data has been received from the device so any reads from the transfer buffer are invalid.
The original code tests !ret, which only catches the timeout case (0). On signal delivery (-ERESTARTSYS), !ret is false so the function skips usbkillurb() and falls through to read from the unfilled transfer buffer.
Fix by capturing the return value into a long (matching the function return type) and handling signal (negative) and timeout (zero) cases with separate checks that both call usbkillurb() before returning.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel hwmon powerz driver are affected. Exploitation requires local access with low privileges.
What conditions are required to trigger the flaw?
A signal must interrupt the driver's wait for a USB request completion. In the vulnerable path, the driver then reads an unfilled transfer buffer because the outstanding URB was not aborted.
What is the impact of successful exploitation?
The stated CVSS vector indicates availability impact only, with no confidentiality or integrity impact. The severity is medium, with a CVSS 3.1 score of 5.5.
What does the fix change?
The fix handles both timeout and signal-interruption return values separately. In either case it calls usb_kill_urb() and returns an error rather than reading the transfer buffer.