CVE-2026-74711

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74711", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.928Z", "datePublished": "2026-08-22T15:33:07.779Z", "dateUpdated": "2026-10-21T12:46:12.854Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:12.854Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n for (i = 0; i < data->num_attributes; i++) {\n struct device_attribute *da = to_dev_attr(data->group.attrs[i]);\n struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n int index = attr->index;\n...\n}\n\nHowever, data->group.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr->index to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flawed pmbus_notify() runs only in the PMBus SMBALERT threaded IRQ handler after the host kernel reads fault status from an on-board I2C/SMBus PSU/PMIC; reaching it requires local presence on a system exposing that bus, not a remote network protocol.\nAC:L - Once SMBALERT IRQ handling is enabled, the type confusion and slab out-of-bounds read occur deterministically on every alert while iterating attributes; an attacker can repeatedly provoke PSU/PMIC faults (e.g., sustained CPU/GPU load) rather than depend on uncontrollable timing.\nPR:N - No special kernel capability is needed to hit the IRQ path\u2014any unprivileged local process that can drive hardware into an overcurrent/overtemp fault (cloud tenant, factory HMI user, embedded service account) can cause SMBALERT and exercise the bug.\nUI:N - Exploitation is driven by attacker-induced or naturally occurring PMBus fault interrupts and does not require any victim to open files, click prompts, or perform other interactive actions.\nS:U - Impact is confined to kernel memory safety within the host OS security authority; it is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority compromise.\nC:H - Casting pmbus_samples_reg device attributes to sensor_device_attribute reads attr->index past the object end (slab out-of-bounds), and pmbus_sensor casts reinterpret adjacent page/phase/reg bytes as an index, enabling kernel heap metadata or pointer disclosure.\nI:H - This is a type confusion in kernel notification logic: mis-decoded indices can spuriously satisfy reg/page/mask checks and drive sysfs_notify/uevent on unintended attributes, a memory-safety defect with potential for further corruption primitives.\nA:H - The out-of-bounds slab read and malformed attribute matching in interrupt context can trigger KASAN/BUG faults or kernel oops/panic when alerts fire on production systems with PMBus SMBALERT wired."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/pmbus/pmbus_core.c"], "versions": [{"version": "f469bde9afd136598a0c4edc054296e6046f90ee", "lessThan": "ce443f6827b97e03a0fb34ebfddc8939c85e0500", "status": "affected", "versionType": "git"}, {"version": "f469bde9afd136598a0c4edc054296e6046f90ee", "lessThan": "1c8dd39d48494cceb2c27c1911cbf26d10ce8514", "status": "affected", "versionType": "git"}, {"version": "f469bde9afd136598a0c4edc054296e6046f90ee", "lessThan": "821f6416e69782fa662aff94b5ea52c943042790", "status": "affected", "versionType": "git"}, {"version": "f469bde9afd136598a0c4edc054296e6046f90ee", "lessThan": "0b121de89a99c54bcf516999b04e8531c84f08d5", "status": "affected", "versionType": "git"}, {"version": "f469bde9afd136598a0c4edc054296e6046f90ee", "lessThan": "59bd68ab05a8f9c9a60b6ec44682084184803ff4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/pmbus/pmbus_core.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce443f6827b97e03a0fb34ebfddc8939c85e0500"}, {"url": "https://git.kernel.org/stable/c/1c8dd39d48494cceb2c27c1911cbf26d10ce8514"}, {"url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"}, {"url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"}, {"url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"}], "title": "hwmon: (pmbus) Fix type confusion in notification logic", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hwmon/pmbus/pmbus_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce443f6827b97e03a0fb34ebfddc8939c85e0500", "status": "affected", "version": "f469bde9afd136598a0c4edc054296e6046f90ee", "versionType": "git"}, {"lessThan": "1c8dd39d48494cceb2c27c1911cbf26d10ce8514", "status": "affected", "version": "f469bde9afd136598a0c4edc054296e6046f90ee", "versionType": "git"}, {"lessThan": "821f6416e69782fa662aff94b5ea52c943042790", "status": "affected", "version": "f469bde9afd136598a0c4edc054296e6046f90ee", "versionType": "git"}, {"lessThan": "0b121de89a99c54bcf516999b04e8531c84f08d5", "status": "affected", "version": "f469bde9afd136598a0c4edc054296e6046f90ee", "versionType": "git"}, {"lessThan": "59bd68ab05a8f9c9a60b6ec44682084184803ff4", "status": "affected", "version": "f469bde9afd136598a0c4edc054296e6046f90ee", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hwmon/pmbus/pmbus_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n for (i = 0; i < data->num_attributes; i++) {\n struct device_attribute *da = to_dev_attr(data->group.attrs[i]);\n struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n int index = attr->index;\n...\n}\n\nHowever, data->group.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr->index to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhwmon: (pmbus) Corrige la confusi\u00f3n de tipos en la l\u00f3gica de notificaci\u00f3n\n\nSashiko informa:\n\nAl inicio del bucle en pmbus_notify(), el c\u00f3digo convierte incondicionalmente cada atributo a una struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n for (i = 0; i < data -> num_attributes; i++) {\n struct device_attribute da = to_dev_attr(data -> group.attrs[i]);\n struct sensor_device_attribute attr = to_sensor_dev_attr(da);\n int index = attr -> index;\n...\n}\n\nSin embargo, data -> group.attrs puede contener otros tipos como struct pmbus_samples_reg o struct pmbus_sensor, que solo incrustan una struct device_attribute base.\n\nSi da es una struct pmbus_samples_reg, dev_attr es el \u00faltimo miembro. Convertirlo a struct sensor_device_attribute y leer el campo index parece acceder a memoria m\u00e1s all\u00e1 del final de la asignaci\u00f3n, lo que podr\u00eda desencadenar una lectura fuera de l\u00edmites de slab.\n\nAdem\u00e1s, si da es una struct pmbus_sensor, convertirlo causa que el campo index se superponga con los campos page, phase y reg. \u00bfPodr\u00eda esto producir una m\u00e1scara de basura en sistemas little-endian que coincida espuriamente con los reg, page y flags objetivo durante una alerta?\n\nSoluciona el problema usando struct sensor_device_attr en struct pmbus_sensor y struct pmbus_label. Dado que esos atributos nunca desencadenan una notificaci\u00f3n, establece el valor de attr -> index en -1 para ellos. Usa este valor para distinguir de los atributos booleanos que _s\u00ed pueden_ desencadenar una notificaci\u00f3n y usan el campo index para codificar los valores de m\u00e1scara, p\u00e1gina y registro."}], "id": "CVE-2026-74711", "lastModified": "2026-10-21T13:19:49.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:45.853", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c8dd39d48494cceb2c27c1911cbf26d10ce8514"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce443f6827b97e03a0fb34ebfddc8939c85e0500"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: hwmon: (pmbus) Fix type confusion in notification logic", "id": "2521404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521404"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nhwmon: (pmbus) Fix type confusion in notification logic\nSashiko reports:\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\nfor (i = 0; i < data->num_attributes; i++) {\nstruct device_attribute *da = to_dev_attr(data->group.attrs[i]);\nstruct sensor_device_attribute *attr = to_sensor_dev_attr(da);\nint index = attr->index;\n...\n}\nHowever, data->group.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr->index to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values.", "A flaw was found in the Linux kernel's hardware monitoring (hwmon) subsystem, specifically within the Power Management Bus (pmbus) driver. This vulnerability arises from a type confusion issue where the system incorrectly interprets data types during notification processing. An attacker could exploit this by manipulating attribute structures, potentially leading to an out-of-bounds read. This could allow for information disclosure or system instability."], "name": "CVE-2026-74711", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74711\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74711\nhttps://lore.kernel.org/linux-cve-announce/2026082238-CVE-2026-74711-988b@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f469bde9afd136598a0c4edc054296e6046f90ee,821f6416e69782fa662aff94b5ea52c943042790)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f469bde9afd136598a0c4edc054296e6046f90ee,0b121de89a99c54bcf516999b04e8531c84f08d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f469bde9afd136598a0c4edc054296e6046f90ee,59bd68ab05a8f9c9a60b6ec44682084184803ff4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.45,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.9,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:30:16.837818+00:00", "updated": "2026-08-25T14:30:19.028543+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-20", "CWE-787", "CWE-843"]}