CVE-2024-26730 (GCVE-0-2024-26730)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:26
VLAI
Title
hwmon: (nct6775) Fix access to temperature configuration registers
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775) Fix access to temperature configuration registers The number of temperature configuration registers does not always match the total number of temperature registers. This can result in access errors reported if KASAN is enabled. BUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b7f1f7b2523a6a4382f12fe953380b847b80e09d , < f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f (git)
Affected: b7f1f7b2523a6a4382f12fe953380b847b80e09d , < c196387820c9214c5ceaff56d77303c82514b8b1 (git)
Affected: b7f1f7b2523a6a4382f12fe953380b847b80e09d , < d56e460e19ea8382f813eb489730248ec8d7eb73 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.970Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26730",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:52:03.714243Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:21.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nct6775-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f",
              "status": "affected",
              "version": "b7f1f7b2523a6a4382f12fe953380b847b80e09d",
              "versionType": "git"
            },
            {
              "lessThan": "c196387820c9214c5ceaff56d77303c82514b8b1",
              "status": "affected",
              "version": "b7f1f7b2523a6a4382f12fe953380b847b80e09d",
              "versionType": "git"
            },
            {
              "lessThan": "d56e460e19ea8382f813eb489730248ec8d7eb73",
              "status": "affected",
              "version": "b7f1f7b2523a6a4382f12fe953380b847b80e09d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nct6775-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nct6775) Fix access to temperature configuration registers\n\nThe number of temperature configuration registers does\nnot always match the total number of temperature registers.\nThis can result in access errors reported if KASAN is enabled.\n\nBUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the nct6775 Super-I/O hardware monitoring driver and is reached only through local driver probe on the LPC/ISA or I2C bus; there is no network, adjacent-network, or physical-access component since the monitoring chip is soldered to the board.\nAC:L - On any system with an NCT6796D-S/NCT6798D/NCT6799D-R Super-I/O chip the mismatched array bound is hit deterministically on every probe, with no race, no memory-layout dependency, and no rare kernel config involved (CONFIG_SENSORS_NCT6775 is shipped as a module by mainstream distributions).\nPR:L - The vulnerable loop is in the probe path, which executes automatically during boot or module load rather than in response to any unprivileged request; a local low-privileged context is the most that can be attributed, and PR:H is not chosen since no attacker action or elevated capability is actually needed for the defect to manifest.\nUI:N - The out-of-bounds access occurs automatically during device probe with no victim action required \u2014 no file must be opened, no filesystem mounted, and no sysfs attribute touched.\nS:U - The out-of-bounds read and the resulting bad register accesses are entirely contained within the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a genuine out-of-bounds read of kernel memory past the end of NCT6779_REG_TEMP_CONFIG, and the disclosed adjacent .rodata contents propagate into persistent driver state (data-\u003ereg_temp_config[]) where they drive further hardware register reads, so the read is treated as a High confidentiality impact per out-of-bounds-read guidance.\nI:L - The out-of-bounds values are consumed as hardware register addresses and written back via nct6775_write_value(), so the driver modifies unintended Super-I/O monitoring registers; this is real but bounded state modification, not an arbitrary kernel write or control-flow hijack primitive.\nA:H - The defect produces a KASAN global-out-of-bounds report that panics the system under panic_on_warn, and the resulting bit-clearing writes to unintended monitoring registers can misconfigure temperature sensing and fan-control state on the hwmon chip, risking thermal instability on embedded and industrial x86 platforms."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:52.871Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73"
        }
      ],
      "title": "hwmon: (nct6775) Fix access to temperature configuration registers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26730",
    "datePublished": "2024-04-03T17:00:18.186Z",
    "dateReserved": "2024-02-19T14:20:24.164Z",
    "dateUpdated": "2026-08-05T11:26:52.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26730",
      "date": "2026-08-10",
      "epss": "0.00248",
      "percentile": "0.16058"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (nct6775) Fix access to temperature configuration registers\\n\\nThe number of temperature configuration registers does\\nnot always match the total number of temperature registers.\\nThis can result in access errors reported if KASAN is enabled.\\n\\nBUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: hwmon: (nct6775) Arreglar el acceso a los registros de configuraci\\u00f3n de temperatura El n\\u00famero de registros de configuraci\\u00f3n de temperatura no siempre coincide con el n\\u00famero total de registros de temperatura. Esto puede resultar en errores de acceso reportados si KASAN est\\u00e1 habilitado. ERROR: KASAN: global fuera de los l\\u00edmites en nct6775_probe+0x5654/0x6fe9 nct6775_core\"}]",
      "id": "CVE-2024-26730",
      "lastModified": "2024-11-21T09:02:56.220",
      "published": "2024-04-03T17:15:50.873",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26730\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:50.873\",\"lastModified\":\"2026-08-04T11:16:59.197\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (nct6775) Fix access to temperature configuration registers\\n\\nThe number of temperature configuration registers does\\nnot always match the total number of temperature registers.\\nThis can result in access errors reported if KASAN is enabled.\\n\\nBUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: hwmon: (nct6775) Arreglar el acceso a los registros de configuraci\u00f3n de temperatura El n\u00famero de registros de configuraci\u00f3n de temperatura no siempre coincide con el n\u00famero total de registros de temperatura. Esto puede resultar en errores de acceso reportados si KASAN est\u00e1 habilitado. ERROR: KASAN: global fuera de los l\u00edmites en nct6775_probe+0x5654/0x6fe9 nct6775_core\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/nct6775-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b7f1f7b2523a6a4382f12fe953380b847b80e09d\",\"lessThan\":\"f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7f1f7b2523a6a4382f12fe953380b847b80e09d\",\"lessThan\":\"c196387820c9214c5ceaff56d77303c82514b8b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b7f1f7b2523a6a4382f12fe953380b847b80e09d\",\"lessThan\":\"d56e460e19ea8382f813eb489730248ec8d7eb73\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/nct6775-core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.19\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.7\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:52:03.714243Z\",\"id\":\"CVE-2024-26730\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.19\",\"matchCriteriaId\":\"67629862-377E-46FA-A747-4A0BC6C42DD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"575EE16B-67F2-4B5B-B5F8-1877715C898B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4950DEE3-1563-46A6-A208-AFB64313B4F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:44:57+00:00",
      "cve": "CVE-2024-26730",
      "id": "CVE-2024-26730",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hwmon: (nct6775) Fix access to temperature configuration registers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26730.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-10-07T00:36:08Z",
      "cve": "CVE-2024-26730",
      "id": "CVE-2024-26730",
      "initial_release_date": "2024-04-10T02:16:35Z",
      "product_status:known_not_affected": "225",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26730",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26730.json",
      "version": "16"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.970Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26730\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:52:03.714243Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.286Z\"}}], \"cna\": {\"title\": \"hwmon: (nct6775) Fix access to temperature configuration registers\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The flaw is in the nct6775 Super-I/O hardware monitoring driver and is reached only through local driver probe on the LPC/ISA or I2C bus; there is no network, adjacent-network, or physical-access component since the monitoring chip is soldered to the board.\\nAC:L - On any system with an NCT6796D-S/NCT6798D/NCT6799D-R Super-I/O chip the mismatched array bound is hit deterministically on every probe, with no race, no memory-layout dependency, and no rare kernel config involved (CONFIG_SENSORS_NCT6775 is shipped as a module by mainstream distributions).\\nPR:L - The vulnerable loop is in the probe path, which executes automatically during boot or module load rather than in response to any unprivileged request; a local low-privileged context is the most that can be attributed, and PR:H is not chosen since no attacker action or elevated capability is actually needed for the defect to manifest.\\nUI:N - The out-of-bounds access occurs automatically during device probe with no victim action required \\u2014 no file must be opened, no filesystem mounted, and no sysfs attribute touched.\\nS:U - The out-of-bounds read and the resulting bad register accesses are entirely contained within the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a genuine out-of-bounds read of kernel memory past the end of NCT6779_REG_TEMP_CONFIG, and the disclosed adjacent .rodata contents propagate into persistent driver state (data-\u003ereg_temp_config[]) where they drive further hardware register reads, so the read is treated as a High confidentiality impact per out-of-bounds-read guidance.\\nI:L - The out-of-bounds values are consumed as hardware register addresses and written back via nct6775_write_value(), so the driver modifies unintended Super-I/O monitoring registers; this is real but bounded state modification, not an arbitrary kernel write or control-flow hijack primitive.\\nA:H - The defect produces a KASAN global-out-of-bounds report that panics the system under panic_on_warn, and the resulting bit-clearing writes to unintended monitoring registers can misconfigure temperature sensing and fan-control state on the hwmon chip, risking thermal instability on embedded and industrial x86 platforms.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b7f1f7b2523a6a4382f12fe953380b847b80e09d\", \"lessThan\": \"f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b7f1f7b2523a6a4382f12fe953380b847b80e09d\", \"lessThan\": \"c196387820c9214c5ceaff56d77303c82514b8b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b7f1f7b2523a6a4382f12fe953380b847b80e09d\", \"lessThan\": \"d56e460e19ea8382f813eb489730248ec8d7eb73\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/hwmon/nct6775-core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/hwmon/nct6775-core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f\"}, {\"url\": \"https://git.kernel.org/stable/c/c196387820c9214c5ceaff56d77303c82514b8b1\"}, {\"url\": \"https://git.kernel.org/stable/c/d56e460e19ea8382f813eb489730248ec8d7eb73\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (nct6775) Fix access to temperature configuration registers\\n\\nThe number of temperature configuration registers does\\nnot always match the total number of temperature registers.\\nThis can result in access errors reported if KASAN is enabled.\\n\\nBUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9 nct6775_core\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:52.871Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26730\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:52.871Z\", \"dateReserved\": \"2024-02-19T14:20:24.164Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:18.186Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.