Vulnerability-Lookup

BDU:2026-16899 (CVE-2026-72395)

Vulnerability from fstec – Published: 2026-10-20 – Updated: 2026-10-20 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции pmbus_regulator_notify_worker() компонента drivers/hwmon/pmbus/pmbus_core.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации

Summary

Уязвимость функции pmbus_regulator_notify_worker() компонента drivers/hwmon/pmbus/pmbus_core.c ядра операционной системы Linux связана с реализацией некорректного потока управления. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на целостность и доступность защищаемой информации

Severity

6.2 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:N/I:C/A:C

7.1 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-691 - Недостаточное управление потоком

Aliases

CVE-2026-72395, GHSA-W4GM-VHRH-5H95

References

11 references

URL
https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f
https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a
https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf
https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047
https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba
https://github.com/advisories/GHSA-w4gm-vhrh-5h95
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/aarch64/updates/
https://security-tracker.debian.org/tracker/CVE-2026-72395
https://deb.freexian.com/extended-lts/tracker/CVE-2026-72395
https://ubuntu.com/security/CVE-2026-72395

Impacted products

4 products from 3 vendors

Vendors

Сообщество свободного программного обеспечения, Canonical Ltd., ООО «Ред Софт»

Products

Debian GNU/Linux, Ubuntu, РЕД ОС (запись в едином реестре российских программ №3751), Linux

Versions

9 (Debian GNU/Linux), 10 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 24.04 LTS (Ubuntu), 13 (Debian GNU/Linux), 8.0 (РЕД ОС), 26.04 LTS (Ubuntu), от 6.12.92 до 6.12.97 (Linux), от 6.6.143 до 6.6.145 (Linux), от 6.18.21 до 6.18.40 (Linux), от 6.19.11 до 7.1.5 (Linux)

Product types

Operating system

Platforms

Сообщество свободного программного обеспечения Debian GNU/Linux 9, Сообщество свободного программного обеспечения Debian GNU/Linux 10, Canonical Ltd. Ubuntu 22.04 LTS, Canonical Ltd. Ubuntu 24.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 13, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Canonical Ltd. Ubuntu 26.04 LTS, Сообщество свободного программного обеспечения Linux от 6.12.92 до 6.12.97, Сообщество свободного программного обеспечения Linux от 6.6.143 до 6.6.145, Сообщество свободного программного обеспечения Linux от 6.18.21 до 6.18.40, Сообщество свободного программного обеспечения Linux от 6.19.11 до 7.1.5

Mitigations

Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047 https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/ http://repo.red-soft.ru/redos/8.0/aarch64/updates/ Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-72395 https://deb.freexian.com/extended-lts/tracker/CVE-2026-72395 Для Ubuntu: https://ubuntu.com/security/CVE-2026-72395

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:N/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Canonical Ltd., \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "9 (Debian GNU/Linux), 10 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 24.04 LTS (Ubuntu), 13 (Debian GNU/Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 26.04 LTS (Ubuntu), \u043e\u0442 6.12.92 \u0434\u043e 6.12.97 (Linux), \u043e\u0442 6.6.143 \u0434\u043e 6.6.145 (Linux), \u043e\u0442 6.18.21 \u0434\u043e 6.18.40 (Linux), \u043e\u0442 6.19.11 \u0434\u043e 7.1.5 (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f\nhttps://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a\nhttps://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf\nhttps://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047\nhttps://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-72395\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-72395\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-72395",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "29.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.10.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-16899",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-72395, GHSA-W4GM-VHRH-5H95",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux, Ubuntu, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Canonical Ltd. Ubuntu 22.04 LTS , Canonical Ltd. Ubuntu 24.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Canonical Ltd. Ubuntu 26.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.12.92 \u0434\u043e 6.12.97 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.6.143 \u0434\u043e 6.6.145 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.18.21 \u0434\u043e 6.18.40 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19.11 \u0434\u043e 7.1.5 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 pmbus_regulator_notify_worker() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 drivers/hwmon/pmbus/pmbus_core.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0442\u043e\u043a\u043e\u043c (CWE-691)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 pmbus_regulator_notify_worker() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 drivers/hwmon/pmbus/pmbus_core.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f\nhttps://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a\nhttps://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf\nhttps://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047\nhttps://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba\nhttps://github.com/advisories/GHSA-w4gm-vhrh-5h95\nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/\nhttp://repo.red-soft.ru/redos/8.0/aarch64/updates/\nhttps://security-tracker.debian.org/tracker/CVE-2026-72395\nhttps://deb.freexian.com/extended-lts/tracker/CVE-2026-72395\nhttps://ubuntu.com/security/CVE-2026-72395",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-691",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,2)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,1)"
}

CVE-2026-72395 (GCVE-0-2026-72395)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:43

Title

hwmon: (pmbus) Fix passing events to regulator core

Summary

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator events over time using atomic_or(). The delayed worker then passes the combined bitmask unmodified to regulator_notifier_call_chain(). The core regulator subsystem's regulator_handle_critical() function evaluates the event parameter using a strict switch statement. If multiple distinct faults occur before the worker runs (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined bitmask fails to match any case. This leaves the reason as NULL and completely bypasses the critical hw_protection_trigger(). Fix the problem by passing events bit by bit to the regulator event handler.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/2106bf4056858fcce…
https://git.kernel.org/stable/c/48fe43666950efefb…
https://git.kernel.org/stable/c/489291b6b56978cc5…
https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef…
https://git.kernel.org/stable/c/9ef7dacd44216bf5e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b26849cffaa7c43355b82e9bef3725e786973a1a , < 2106bf4056858fcce3624e0c51f6fee4d41d3f2f (git) Affected: acf04e2863132f6d9222f71f3a76fb9782cbe061 , < 48fe43666950efefb7ac5fbdc012c1b3604096bf (git) Affected: 4e9d723d9f198b86f6882a84c501ba1f39e8d055 , < 489291b6b56978cc50d34e8e13f9636ea296ba8a (git) Affected: 754bd2b4a084b90b5e7b630e1f423061a9b9b761 , < b0ff6b6ae9c5183ef701ece7016698bde5a5bfba (git) Affected: 754bd2b4a084b90b5e7b630e1f423061a9b9b761 , < 9ef7dacd44216bf5ea05c8aef49eba4d145f4047 (git) Affected: 2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07 (git) Affected: 6.6.143 , < 6.6.145 (semver) Affected: 6.12.92 , < 6.12.97 (semver) Affected: 6.18.21 , < 6.18.40 (semver) Affected: 6.19.11 , < 6.20 (semver)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/pmbus_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2106bf4056858fcce3624e0c51f6fee4d41d3f2f",
              "status": "affected",
              "version": "b26849cffaa7c43355b82e9bef3725e786973a1a",
              "versionType": "git"
            },
            {
              "lessThan": "48fe43666950efefb7ac5fbdc012c1b3604096bf",
              "status": "affected",
              "version": "acf04e2863132f6d9222f71f3a76fb9782cbe061",
              "versionType": "git"
            },
            {
              "lessThan": "489291b6b56978cc50d34e8e13f9636ea296ba8a",
              "status": "affected",
              "version": "4e9d723d9f198b86f6882a84c501ba1f39e8d055",
              "versionType": "git"
            },
            {
              "lessThan": "b0ff6b6ae9c5183ef701ece7016698bde5a5bfba",
              "status": "affected",
              "version": "754bd2b4a084b90b5e7b630e1f423061a9b9b761",
              "versionType": "git"
            },
            {
              "lessThan": "9ef7dacd44216bf5ea05c8aef49eba4d145f4047",
              "status": "affected",
              "version": "754bd2b4a084b90b5e7b630e1f423061a9b9b761",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.40",
              "status": "affected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/pmbus_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.143",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix passing events to regulator core\n\nSashiko reports:\n\nCommit 754bd2b4a084 (\"hwmon: (pmbus/core) Protect regulator operations with\nmutex\") introduced a worker to batch regulator events over time using\natomic_or(). The delayed worker then passes the combined bitmask unmodified\nto regulator_notifier_call_chain().\n\nThe core regulator subsystem\u0027s regulator_handle_critical() function\nevaluates the event parameter using a strict switch statement. If\nmultiple distinct faults occur before the worker runs (e.g.,\nREGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined\nbitmask fails to match any case. This leaves the reason as NULL and\ncompletely bypasses the critical hw_protection_trigger().\n\nFix the problem by passing events bit by bit to the regulator event\nhandler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable through the PMBus SMBALERT threaded IRQ handler (pmbus_fault_handler) that reads hardware fault status over I2C; there is no network, adjacent-radio, or direct physical-device API path, but local actors on PMBus-equipped servers, routers, and embedded boards can induce multi-fault conditions.\nAC:L - _pmbus_get_flags() ORs multiple REGULATOR_EVENT_* bits from a single STATUS read, and pmbus_regulator_notify() further batches concurrent IRQs via atomic_or() before the worker runs, so combined masks like UNDER_VOLTAGE|OVER_CURRENT are produced deterministically without races or layout dependencies the attacker cannot influence.\nPR:L - Triggering the IRQ requires causing real PMBus regulator fault bits (e.g., over-current plus under-voltage during supply stress), which an unprivileged local user can induce through heavy workload and power instability on affected platforms; CAP_NET_ADMIN/user-namespace tricks are not needed and no init-namespace root capability is required.\nUI:N - Once fault conditions are present the SMBALERT IRQ and workqueue fire automatically through pmbus_fault_handler and pmbus_regulator_notify_worker; no separate victim action such as mounting media, plugging hardware, or approving a prompt is required.\nS:U - The impact is bypassing kernel hw_protection_trigger() orderly shutdown/reboot for system-critical PMBus regulators on the same host; it does not cross VM, IOMMU, or sandbox security boundaries and is not a guest-to-host escape.\nC:N - This is a notifier bit-mask logic error that leaves regulator_handle_critical() with a NULL reason; there is no kernel memory corruption, use-after-free, or out-of-bounds access that could disclose pointers or arbitrary memory.\nI:H - When multiple distinct fault events are combined, hw_protection_trigger() is completely skipped for system-critical regulators, defeating the kernel\u0027s mandatory emergency shutdown policy and allowing continued operation under simultaneous critical under-voltage/over-current/fail conditions that can corrupt power hardware.\nA:H - Bypassing hw_protection_trigger() during simultaneous critical PMBus regulator faults prevents the intended emergency orderly_poweroff/reboot, leaving telecom, data-center, and embedded systems running under dangerous rail conditions that can cause hardware failure, forced resets, and sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:38.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047"
        }
      ],
      "title": "hwmon: (pmbus) Fix passing events to regulator core",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72395",
    "datePublished": "2026-08-15T05:56:22.400Z",
    "dateReserved": "2026-08-09T03:40:39.924Z",
    "dateUpdated": "2026-08-17T05:43:38.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-W4GM-VHRH-5H95

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus) Fix passing events to regulator core

Sashiko reports:

Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator events over time using atomic_or(). The delayed worker then passes the combined bitmask unmodified to regulator_notifier_call_chain().

The core regulator subsystem's regulator_handle_critical() function evaluates the event parameter using a strict switch statement. If multiple distinct faults occur before the worker runs (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined bitmask fails to match any case. This leaves the reason as NULL and completely bypasses the critical hw_protection_trigger().

Fix the problem by passing events bit by bit to the regulator event handler.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72395"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:13Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix passing events to regulator core\n\nSashiko reports:\n\nCommit 754bd2b4a084 (\"hwmon: (pmbus/core) Protect regulator operations with\nmutex\") introduced a worker to batch regulator events over time using\natomic_or(). The delayed worker then passes the combined bitmask unmodified\nto regulator_notifier_call_chain().\n\nThe core regulator subsystem\u0027s regulator_handle_critical() function\nevaluates the event parameter using a strict switch statement. If\nmultiple distinct faults occur before the worker runs (e.g.,\nREGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined\nbitmask fails to match any case. This leaves the reason as NULL and\ncompletely bypasses the critical hw_protection_trigger().\n\nFix the problem by passing events bit by bit to the regulator event\nhandler.",
  "id": "GHSA-w4gm-vhrh-5h95",
  "modified": "2026-08-17T06:33:27Z",
  "published": "2026-08-15T06:32:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72395"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-16899 (CVE-2026-72395)

CVE-2026-72395 (GCVE-0-2026-72395)

GHSA-W4GM-VHRH-5H95

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour