CVE-2026-80745: regulator: fp9931: Fix VPOS/VNEG voltage selector table
In the Linux kernel, the following vulnerability has been resolved:
regulator: fp9931: Fix VPOS/VNEG voltage selector table
The VPOSNEGtable[] mapping does not match the FP9931 datasheet.
The datasheet defines the VPOS/VNEG voltage mapping as:
00h-04h -> 7.04V (-7.04V) 05h -> 7.26V (-7.26V) 06h -> 7.49V (-7.49V) ... 28h-3Fh -> 15.06V (-15.06V)
However, VPOSNEGtable[] has two issues:
1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the table has 6 entries of 7.04V, causing all subsequent entries to be shifted by one position.
2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but the table has only 41 entries. Any selector value above 0x28 would result in an out-of-bounds table access.
Fix both issues by removing the duplicate 7.04V entry and appending the missing 23 clamped 15.06V entries, bringing the table to the correct size of 64 entries (0x00~0x3F).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the fp9931 VPOS/VNEG voltage selector table (VPOSNEG_table[]) so it contains the correct 64 entries (0x00~0x3F) per the FP9931 datasheet: ensure 0x00~0x04 map to 7.04V (5 entries), selectors 0x29~0x3F clamp to 15.06V (23 entries), and remove the duplicate 7.04V entry that shifts subsequent mappings to prevent out-of-bounds table access.
Linux kernel fp9931 regulator driver VPOSNEG_table[] voltage selector mapping (FP9931 datasheet alignment) = Remove the duplicate 7.04V entry and correct the table to a size of 64 entries for selector values 0x00~0x3F, where selectors 0x00~0x04 map to 7.04V and selectors 0x29~0x3F clamp to 15.06V
Event History
Frequently Asked Questions
Which systems are exposed to the out-of-bounds access?
Systems using the Linux kernel FP9931 regulator driver are exposed when a VPOS or VNEG selector above 0x28 is used. The affected selector range is 0x29 through 0x3F, because the original voltage table had only 41 entries.
What operational impact can occur even for selector values within the table bounds?
Selector values after the duplicated 7.04V entry map to the wrong voltage because all subsequent table entries are shifted by one position. This can cause VPOS/VNEG to be configured differently from the FP9931 datasheet mapping.
How can I determine whether the correction is present?
Verify that the FP9931 VPOS/VNEG selector table has 64 entries covering selectors 0x00 through 0x3F, with selectors 0x00-0x04 mapped to 7.04V and selectors 0x29-0x3F clamped to 15.06V. The listed stable kernel references contain the fixes.