CVE-2026-74547: hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
When userspace configures 'autoupdateinterval' to 0 via sysfs, the background kthread executes scheduletimeoutinterruptible(0), which returns immediately.
If 'numtempsensors' is concurrently or previously set to 0, the msleepinterruptible() delay inside adt7470readtemperatures() also becomes 0. This combination forces the background thread into a tight, unbounded busy-loop, hogging the CPU and flooding the I2C bus with a continuous stream of transactions.
Fix this vulnerability by raising the lower limit of the clampval in autoupdateintervalstore() from 0 to 500 milliseconds. This guarantees a reasonable minimum sleep window between sensor updates, protecting the system from intentional or accidental I2C bus denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Increase the lower bound used to clamp 'auto_update_interval' so that auto_update_interval_store() does not allow a 0 ms update interval, preventing the background thread from calling schedule_timeout_interruptible(0) and avoiding the resulting busy-loop and I2C flooding.
Linux kernel hwmon (adt7470) clamp_val (lower limit) = raise lower limit - Configuration
Modify auto_update_interval_store() so that when userspace writes auto_update_interval=0 via sysfs, the value is clamped to a non-zero minimum (a reasonable minimum sleep window between sensor updates) rather than permitting 0ms; this prevents msleep_interruptible() from returning immediately and reduces CPU hogging and I2C bus denial-of-service.
Linux kernel hwmon (adt7470) auto_update_interval_store() handling of 0..500ms = clamp to minimum within 0..500ms range
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74547?
The severity of CVE-2026-74547 is rated at risk level 26.
How do I fix CVE-2026-74547?
To fix CVE-2026-74547, ensure that the Linux kernel is updated to the latest patched version that addresses this vulnerability.
What is the impact of CVE-2026-74547?
CVE-2026-74547 can lead to a busy-loop condition and I2C flooding, potentially affecting system performance.
Who is affected by CVE-2026-74547?
CVE-2026-74547 affects userspace applications that interact with the hwmon module in the Linux kernel.
What components are involved in CVE-2026-74547?
CVE-2026-74547 specifically involves the hwmon driver for the adt7470 sensor in the Linux kernel.