UBUNTU-CVE-2026-74685: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Clamp negative current limits When a negative value is passed to ltc4282writecurr(), the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr() { / need to pass it in millivolt / u32 in = DIVROUNDCLOSESTULL((u64)val st->rsense, DECA MICRO); ... } This cast converts negative inputs into large positive values. The subsequent division result overflows the u32 in variable, truncating to a pseudo-random positive value. When this is passed to ltc4282writevoltagebyte(), it is clamped to the maximum limit instead of zero. Clamp val to 0 and to the maximum supported upper limit before the cast and assign the result to a 64-bit temporary variable before the division to avoid the underflow and an also possible overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel ltc4282 driver, clamp the input val in ltc4282_write_curr() to 0 and the maximum supported upper limit before casting it, then assign the clamped value to a 64-bit temporary variable before performing the division.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the LTC4282 hardware-monitoring driver in the listed Ubuntu kernel packages. Exposure requires hardware and a configuration that use the ltc4282 driver; the provided data does not establish that systems without this device or driver are affected.
What input is required to trigger the faulty behavior?
A negative current-limit value must be passed to ltc4282_write_curr(). The signed value is converted to an unsigned 64-bit value, which can lead to truncation and cause the programmed limit to be clamped to its maximum rather than zero.
What is the practical impact of a successful trigger?
Instead of rejecting or treating a negative current limit as zero, the driver may program the maximum limit. This can result from the overflow and truncation producing a positive value that is then clamped by the voltage-byte write path.
What does the fix change?
The fix clamps the requested value to zero and the maximum supported upper limit before converting it to an unsigned type. It also uses a 64-bit temporary for the division result to avoid both the negative-value underflow and a possible overflow.