CVE-2026-74711: hwmon: (pmbus) Fix type confusion in notification logic
hwmon: (pmbus) Fix type confusion in notification logic
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Compensating control
In the PMBus notification logic, use struct sensor_device_attr in struct pmbus_sensor and struct pmbus_label, and set attr->index to -1 for attributes that never trigger notifications so they are distinguished from boolean notification attributes.
Event History
Frequently Asked Questions
Which systems are most relevant to this issue?
Systems using the Linux kernel PMBus hwmon driver and its notification handling are relevant. The unsafe path occurs when the driver's attribute group includes PMBus-specific attribute types such as pmbus_samples_reg or pmbus_sensor rather than only sensor_device_attribute entries.
What condition triggers the faulty behavior?
The notification loop must process an attribute that is not actually a sensor_device_attribute. The code then interprets that object as the wrong type and reads an index field from an invalid or overlapping memory location.
What are the potential effects of the incorrect cast?
For a pmbus_samples_reg attribute, the cast can read beyond the allocation and may cause a slab out-of-bounds read. For a pmbus_sensor attribute, overlapping fields can produce a garbage mask that may spuriously match an alert's register, page, and flags.
Is a fix available?
The issue is described as resolved, with fixes referenced in stable commits 821f6416e69782fa662aff94b5ea52c943042790, 0b121de89a99c54bcf516999b04e8531c84f08d5, and 59bd68ab05a8f9c9a60b6ec44682084184803ff4. The provided data does not map those commits to specific kernel release versions.