CVE-2026-80696

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80696", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.785Z", "datePublished": "2026-08-28T06:53:01.632Z", "dateUpdated": "2026-08-29T06:22:19.564Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:19.564Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Fix reading the minimum alarm voltage\n\nCoverity reports an out-of-bounds access when reading the minimum alarm\nvoltage for the VGPIO channel. Add the missing return statement to fix\nthe problem."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by a local read(2) on /sys/class/hwmon/hwmonN/in2_min_alarm (sysfs -> hwmon_attr_show -> ltc4282_read -> ltc4282_read_in); the LTC4282 I2C hwmon driver has no network, wireless, or direct physical-bus attack surface.\nAC:L - On systems with an LTC4282 bound, any read of in2_min_alarm deterministically executes the missing-return fallthrough and out-of-bounds in0_1_cache[2].en access; the attacker fully controls triggering with no race or conditions outside their control.\nPR:L - in2_min_alarm is exposed as mode 0444 with no capability checks beyond standard sysfs permissions, so any unprivileged local user on a host with LTC4282 hardware can invoke the vulnerable read path without init-namespace root or user-namespace privileges.\nUI:N - Exploitation requires only the attacker (or attacker-controlled monitoring software) to read the hwmon sysfs attribute; no separate victim action such as plugging hardware, mounting filesystems, or approving prompts is needed.\nS:U - The out-of-bounds read and conditional hardware alarm-bit clearing remain within the host kernel/driver context managing the local LTC4282; they do not cross VM, container, IOMMU, or other changed security-authority boundaries.\nC:H - The fallthrough indexes in0_1_cache[2] past the two-element array, performing an out-of-bounds read of adjacent ltc4282_state memory (energy_en/padding) that steers control flow and can return incorrect in2_min_alarm data to userspace.\nI:H - When the out-of-bounds .en byte is non-zero, the fallthrough calls __ltc4282_read_alarm() with VSOURCE_ALARM_L_MASK, clearing the VSOURCE undervoltage alarm bit on the live LTC4282 hot-swap controller and corrupting safety-critical power-rail monitoring on datacenter/telecom racks.\nA:H - Clearing VSOURCE undervoltage alarms on an LTC4282 controlling live backplane/linecard hot-swap power can mask critical rail faults, enabling undetected power events and sustained rack or linecard outages on affected server and industrial deployments."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/ltc4282.c"], "versions": [{"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "lessThan": "338d655fe09b95a88788c6ac8b1651ca8db9ae51", "status": "affected", "versionType": "git"}, {"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "lessThan": "08aee6d45eefc9e0b94c21bd442f47b21d64fa2c", "status": "affected", "versionType": "git"}, {"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "lessThan": "a0668ac20feaa3fff9e0c0548556368dbbd2d439", "status": "affected", "versionType": "git"}, {"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "lessThan": "00feb1cce93dab948a299b69753d99c681d45a0b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwmon/ltc4282.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/338d655fe09b95a88788c6ac8b1651ca8db9ae51"}, {"url": "https://git.kernel.org/stable/c/08aee6d45eefc9e0b94c21bd442f47b21d64fa2c"}, {"url": "https://git.kernel.org/stable/c/a0668ac20feaa3fff9e0c0548556368dbbd2d439"}, {"url": "https://git.kernel.org/stable/c/00feb1cce93dab948a299b69753d99c681d45a0b"}], "title": "hwmon: (ltc4282) Fix reading the minimum alarm voltage", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hwmon/ltc4282.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "338d655fe09b95a88788c6ac8b1651ca8db9ae51", "status": "affected", "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "versionType": "git"}, {"lessThan": "08aee6d45eefc9e0b94c21bd442f47b21d64fa2c", "status": "affected", "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "versionType": "git"}, {"lessThan": "a0668ac20feaa3fff9e0c0548556368dbbd2d439", "status": "affected", "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "versionType": "git"}, {"lessThan": "00feb1cce93dab948a299b69753d99c681d45a0b", "status": "affected", "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hwmon/ltc4282.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Fix reading the minimum alarm voltage\n\nCoverity reports an out-of-bounds access when reading the minimum alarm\nvoltage for the VGPIO channel. Add the missing return statement to fix\nthe problem."}], "id": "CVE-2026-80696", "lastModified": "2026-08-29T07:16:51.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-28T08:16:55.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00feb1cce93dab948a299b69753d99c681d45a0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08aee6d45eefc9e0b94c21bd442f47b21d64fa2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/338d655fe09b95a88788c6ac8b1651ca8db9ae51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0668ac20feaa3fff9e0c0548556368dbbd2d439"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: hwmon: (ltc4282) Fix reading the minimum alarm voltage", "id": "2525426", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525426"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nhwmon: (ltc4282) Fix reading the minimum alarm voltage\nCoverity reports an out-of-bounds access when reading the minimum alarm\nvoltage for the VGPIO channel. Add the missing return statement to fix\nthe problem.", "A flaw was found in the Linux kernel's hwmon ltc4282 driver. This vulnerability occurs due to an out-of-bounds read when processing the minimum alarm voltage for the VGPIO channel, caused by a missing return statement. A local attacker could potentially exploit this to cause a denial of service or obtain incorrect system readings."], "name": "CVE-2026-80696", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80696\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80696\nhttps://lore.kernel.org/linux-cve-announce/2026082805-CVE-2026-80696-bb01@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,338d655fe09b95a88788c6ac8b1651ca8db9ae51)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,08aee6d45eefc9e0b94c21bd442f47b21d64fa2c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,a0668ac20feaa3fff9e0c0548556368dbbd2d439)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc29538dbf7d7400f1ffc5dd5713e6a551463a0,00feb1cce93dab948a299b69753d99c681d45a0b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T11:30:06.782866+00:00", "updated": "2026-08-29T10:30:08.638573+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}