GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74711 (GCVE-0-2026-74711)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
Title
hwmon: (pmbus) Fix type confusion in notification logic
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbus_notify(), the code unconditionally casts every attribute to a struct sensor_device_attribute: drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() { for (i = 0; i < data->num_attributes; i++) { struct device_attribute *da = to_dev_attr(data->group.attrs[i]); struct sensor_device_attribute *attr = to_sensor_dev_attr(da); int index = attr->index; ... } However, data->group.attrs can contain other types like struct pmbus_samples_reg or struct pmbus_sensor, which only embed a base struct device_attribute. If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting it to struct sensor_device_attribute and reading the index field appears to access memory past the end of the allocation, which might trigger a slab-out-of-bounds read. Additionally, if da is a struct pmbus_sensor, casting it causes the index field to overlap with the page, phase, and reg fields. Could this produce a garbage mask on little-endian systems that spuriously matches the target reg, page, and flags during an alert? Fix the problem by using struct sensor_device_attr in struct pmbus_sensor and struct pmbus_label. Since those attributes never trigger a notification, set the value of attr->index to -1 for them. Use this value to distinguish from boolean attributes which _can_ trigger a notification and use the index field to encode mask, page, and register values.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 821f6416e69782fa662aff94b5ea52c943042790 (git)
Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 0b121de89a99c54bcf516999b04e8531c84f08d5 (git)
Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 59bd68ab05a8f9c9a60b6ec44682084184803ff4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/pmbus_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "821f6416e69782fa662aff94b5ea52c943042790",
              "status": "affected",
              "version": "f469bde9afd136598a0c4edc054296e6046f90ee",
              "versionType": "git"
            },
            {
              "lessThan": "0b121de89a99c54bcf516999b04e8531c84f08d5",
              "status": "affected",
              "version": "f469bde9afd136598a0c4edc054296e6046f90ee",
              "versionType": "git"
            },
            {
              "lessThan": "59bd68ab05a8f9c9a60b6ec44682084184803ff4",
              "status": "affected",
              "version": "f469bde9afd136598a0c4edc054296e6046f90ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/pmbus_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n    for (i = 0; i \u003c data-\u003enum_attributes; i++) {\n        struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\n        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n        int index = attr-\u003eindex;\n...\n}\n\nHowever, data-\u003egroup.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flawed pmbus_notify() runs only in the PMBus SMBALERT threaded IRQ handler after the host kernel reads fault status from an on-board I2C/SMBus PSU/PMIC; reaching it requires local presence on a system exposing that bus, not a remote network protocol.\nAC:L - Once SMBALERT IRQ handling is enabled, the type confusion and slab out-of-bounds read occur deterministically on every alert while iterating attributes; an attacker can repeatedly provoke PSU/PMIC faults (e.g., sustained CPU/GPU load) rather than depend on uncontrollable timing.\nPR:N - No special kernel capability is needed to hit the IRQ path\u2014any unprivileged local process that can drive hardware into an overcurrent/overtemp fault (cloud tenant, factory HMI user, embedded service account) can cause SMBALERT and exercise the bug.\nUI:N - Exploitation is driven by attacker-induced or naturally occurring PMBus fault interrupts and does not require any victim to open files, click prompts, or perform other interactive actions.\nS:U - Impact is confined to kernel memory safety within the host OS security authority; it is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority compromise.\nC:H - Casting pmbus_samples_reg device attributes to sensor_device_attribute reads attr-\u003eindex past the object end (slab out-of-bounds), and pmbus_sensor casts reinterpret adjacent page/phase/reg bytes as an index, enabling kernel heap metadata or pointer disclosure.\nI:H - This is a type confusion in kernel notification logic: mis-decoded indices can spuriously satisfy reg/page/mask checks and drive sysfs_notify/uevent on unintended attributes, a memory-safety defect with potential for further corruption primitives.\nA:H - The out-of-bounds slab read and malformed attribute matching in interrupt context can trigger KASAN/BUG faults or kernel oops/panic when alerts fire on production systems with PMBus SMBALERT wired."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:53.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"
        }
      ],
      "title": "hwmon: (pmbus) Fix type confusion in notification logic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74711",
    "datePublished": "2026-08-22T15:33:07.779Z",
    "dateReserved": "2026-08-15T05:44:03.928Z",
    "dateUpdated": "2026-08-25T05:41:53.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74711",
      "date": "2026-09-17",
      "epss": "0.0014",
      "percentile": "0.03751"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:45:38.000Z",
      "cve": "CVE-2026-74711",
      "id": "msrc_CVE-2026-74711",
      "initial_release_date": "2026-08-24T01:12:08.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hwmon: (pmbus) Fix type confusion in notification logic",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74711.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74711\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:45.853\",\"lastModified\":\"2026-08-25T06:18:55.940\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (pmbus) Fix type confusion in notification logic\\n\\nSashiko reports:\\n\\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\\nevery attribute to a struct sensor_device_attribute:\\n\\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\\n    for (i = 0; i \u003c data-\u003enum_attributes; i++) {\\n        struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\\n        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\\n        int index = attr-\u003eindex;\\n...\\n}\\n\\nHowever, data-\u003egroup.attrs can contain other types like struct\\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\\nstruct device_attribute.\\n\\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\\nit to struct sensor_device_attribute and reading the index field appears\\nto access memory past the end of the allocation, which might trigger a\\nslab-out-of-bounds read.\\n\\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\\nfield to overlap with the page, phase, and reg fields. Could this produce\\na garbage mask on little-endian systems that spuriously matches the target\\nreg, page, and flags during an alert?\\n\\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\\nand struct pmbus_label. Since those attributes never trigger a\\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\\nto distinguish from boolean attributes which _can_ trigger a notification\\nand use the index field to encode mask, page, and register values.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/pmbus/pmbus_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f469bde9afd136598a0c4edc054296e6046f90ee\",\"lessThan\":\"821f6416e69782fa662aff94b5ea52c943042790\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f469bde9afd136598a0c4edc054296e6046f90ee\",\"lessThan\":\"0b121de89a99c54bcf516999b04e8531c84f08d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f469bde9afd136598a0c4edc054296e6046f90ee\",\"lessThan\":\"59bd68ab05a8f9c9a60b6ec44682084184803ff4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/pmbus/pmbus_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:55:21+00:00",
      "cve": "CVE-2026-74711",
      "id": "CVE-2026-74711",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hwmon: (pmbus) Fix type confusion in notification logic",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74711.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:16:05Z",
      "cve": "CVE-2026-74711",
      "id": "CVE-2026-74711",
      "initial_release_date": "2026-08-26T01:11:59Z",
      "product_status:known_affected": "118",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74711",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74711.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.