CVE-2026-74711 (GCVE-0-2026-74711)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
hwmon: (pmbus) Fix type confusion in notification logic
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus) Fix type confusion in notification logic
Sashiko reports:
At the start of the loop in pmbus_notify(), the code unconditionally casts
every attribute to a struct sensor_device_attribute:
drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {
for (i = 0; i < data->num_attributes; i++) {
struct device_attribute *da = to_dev_attr(data->group.attrs[i]);
struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
int index = attr->index;
...
}
However, data->group.attrs can contain other types like struct
pmbus_samples_reg or struct pmbus_sensor, which only embed a base
struct device_attribute.
If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting
it to struct sensor_device_attribute and reading the index field appears
to access memory past the end of the allocation, which might trigger a
slab-out-of-bounds read.
Additionally, if da is a struct pmbus_sensor, casting it causes the index
field to overlap with the page, phase, and reg fields. Could this produce
a garbage mask on little-endian systems that spuriously matches the target
reg, page, and flags during an alert?
Fix the problem by using struct sensor_device_attr in struct pmbus_sensor
and struct pmbus_label. Since those attributes never trigger a
notification, set the value of attr->index to -1 for them. Use this value
to distinguish from boolean attributes which _can_ trigger a notification
and use the index field to encode mask, page, and register values.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
f469bde9afd136598a0c4edc054296e6046f90ee , < 821f6416e69782fa662aff94b5ea52c943042790
(git)
Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 0b121de89a99c54bcf516999b04e8531c84f08d5 (git) Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 59bd68ab05a8f9c9a60b6ec44682084184803ff4 (git) |
guessed | |
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "821f6416e69782fa662aff94b5ea52c943042790",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "0b121de89a99c54bcf516999b04e8531c84f08d5",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "59bd68ab05a8f9c9a60b6ec44682084184803ff4",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n for (i = 0; i \u003c data-\u003enum_attributes; i++) {\n struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\n struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n int index = attr-\u003eindex;\n...\n}\n\nHowever, data-\u003egroup.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:07.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"
},
{
"url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"
},
{
"url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"
}
],
"title": "hwmon: (pmbus) Fix type confusion in notification logic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74711",
"datePublished": "2026-08-22T15:33:07.779Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-22T15:33:07.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74711\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:45.853\",\"lastModified\":\"2026-08-22T16:16:45.853\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (pmbus) Fix type confusion in notification logic\\n\\nSashiko reports:\\n\\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\\nevery attribute to a struct sensor_device_attribute:\\n\\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\\n for (i = 0; i \u003c data-\u003enum_attributes; i++) {\\n struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\\n struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\\n int index = attr-\u003eindex;\\n...\\n}\\n\\nHowever, data-\u003egroup.attrs can contain other types like struct\\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\\nstruct device_attribute.\\n\\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\\nit to struct sensor_device_attribute and reading the index field appears\\nto access memory past the end of the allocation, which might trigger a\\nslab-out-of-bounds read.\\n\\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\\nfield to overlap with the page, phase, and reg fields. Could this produce\\na garbage mask on little-endian systems that spuriously matches the target\\nreg, page, and flags during an alert?\\n\\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\\nand struct pmbus_label. Since those attributes never trigger a\\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\\nto distinguish from boolean attributes which _can_ trigger a notification\\nand use the index field to encode mask, page, and register values.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/pmbus/pmbus_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f469bde9afd136598a0c4edc054296e6046f90ee\",\"lessThan\":\"821f6416e69782fa662aff94b5ea52c943042790\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f469bde9afd136598a0c4edc054296e6046f90ee\",\"lessThan\":\"0b121de89a99c54bcf516999b04e8531c84f08d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f469bde9afd136598a0c4edc054296e6046f90ee\",\"lessThan\":\"59bd68ab05a8f9c9a60b6ec44682084184803ff4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/pmbus/pmbus_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…