{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74711","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.928Z","datePublished":"2026-08-22T15:33:07.779Z","dateUpdated":"2026-08-25T05:41:53.683Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-25T05:41:53.683Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n    for (i = 0; i < data->num_attributes; i++) {\n        struct device_attribute *da = to_dev_attr(data->group.attrs[i]);\n        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n        int index = attr->index;\n...\n}\n\nHowever, data->group.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr->index to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flawed pmbus_notify() runs only in the PMBus SMBALERT threaded IRQ handler after the host kernel reads fault status from an on-board I2C/SMBus PSU/PMIC; reaching it requires local presence on a system exposing that bus, not a remote network protocol.\nAC:L - Once SMBALERT IRQ handling is enabled, the type confusion and slab out-of-bounds read occur deterministically on every alert while iterating attributes; an attacker can repeatedly provoke PSU/PMIC faults (e.g., sustained CPU/GPU load) rather than depend on uncontrollable timing.\nPR:N - No special kernel capability is needed to hit the IRQ path—any unprivileged local process that can drive hardware into an overcurrent/overtemp fault (cloud tenant, factory HMI user, embedded service account) can cause SMBALERT and exercise the bug.\nUI:N - Exploitation is driven by attacker-induced or naturally occurring PMBus fault interrupts and does not require any victim to open files, click prompts, or perform other interactive actions.\nS:U - Impact is confined to kernel memory safety within the host OS security authority; it is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority compromise.\nC:H - Casting pmbus_samples_reg device attributes to sensor_device_attribute reads attr->index past the object end (slab out-of-bounds), and pmbus_sensor casts reinterpret adjacent page/phase/reg bytes as an index, enabling kernel heap metadata or pointer disclosure.\nI:H - This is a type confusion in kernel notification logic: mis-decoded indices can spuriously satisfy reg/page/mask checks and drive sysfs_notify/uevent on unintended attributes, a memory-safety defect with potential for further corruption primitives.\nA:H - The out-of-bounds slab read and malformed attribute matching in interrupt context can trigger KASAN/BUG faults or kernel oops/panic when alerts fire on production systems with PMBus SMBALERT wired."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwmon/pmbus/pmbus_core.c"],"versions":[{"version":"f469bde9afd136598a0c4edc054296e6046f90ee","lessThan":"821f6416e69782fa662aff94b5ea52c943042790","status":"affected","versionType":"git"},{"version":"f469bde9afd136598a0c4edc054296e6046f90ee","lessThan":"0b121de89a99c54bcf516999b04e8531c84f08d5","status":"affected","versionType":"git"},{"version":"f469bde9afd136598a0c4edc054296e6046f90ee","lessThan":"59bd68ab05a8f9c9a60b6ec44682084184803ff4","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwmon/pmbus/pmbus_core.c"],"versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","status":"unaffected","versionType":"semver"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"},{"url":"https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"},{"url":"https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"}],"title":"hwmon: (pmbus) Fix type confusion in notification logic","x_generator":{"engine":"bippy-1.2.0"}}}}