Linux Kernel CVE-2026-46007

The powerz driver (drivers/hwmon/powerz.c), introduced via commit 4381a36abdf1c5c0323c1c51f869dc000115eb20, manages a USB-based power/energy monitor device. It allocates a transfer buffer for DMA operations, but on architectures that lack transparent DMA cache coherency (e.g., non-coherent ARM or MIPS platforms), placing this DMA buffer adjacent in memory to a mutex means a CPU cacheline may span both objects. When the DMA controller writes to the buffer, it can silently overwrite or corrupt the cached copy of the mutex (or vice versa), since DMA bypasses CPU caches. The fix migrates to high-level DMA coherent allocation helpers (dma_alloc_coherent or equivalent), which guarantee separate, uncached mappings that cannot alias with other kernel data structures. CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. No CWE is formally assigned, but this maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) or more precisely to improper DMA buffer isolation, a subclass of hardware-software interface misuse.