CVE-2026-72397: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/core) honor vrmversion in pmbusdata2regvid()
pmbusdata2regvid() hardcoded the VR11 encoding regardless of the vrmversion configured by the driver, while pmbusreg2datavid() already switched on it. Any driver that selects a non-VR11 VID mode and exposes a regulator (or hwmon vout setter) sent dangerously wrong codes to PMBUSVOUTCOMMAND -- e.g. an nvidia195mv part asked for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the chip interprets as 1080 mV.
Mirror pmbusreg2datavid() so writes round-trip with reads.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72397?
CVE-2026-72397 has a risk level of 34, indicating a moderate severity vulnerability.
How does CVE-2026-72397 affect the Linux kernel?
CVE-2026-72397 affects the Linux kernel by not honoring the configured vrm_version in pmbus_data2reg_vid(), leading to incorrect handling of voltage regulation.
What systems are impacted by CVE-2026-72397?
CVE-2026-72397 impacts systems that utilize the hwmon subsystem, specifically those relying on pmbus devices.
How do I fix CVE-2026-72397?
To fix CVE-2026-72397, update your Linux kernel to the version that includes the patch resolving this vulnerability.
When was CVE-2026-72397 published?
CVE-2026-72397 was published on August 15, 2026.