Linux Kernel CVE-2026-72395

The flaw resides in the Linux kernel's PMBus (Power Management Bus) hardware monitor driver, introduced by commit 754bd2b4a084 ('hwmon: (pmbus/core) Protect regulator operations with mutex'). That commit added a delayed worker that uses atomic_or() to batch concurrent regulator events before dispatch. The defect emerges when two or more distinct hardware fault conditions - for example REGULATOR_EVENT_UNDER_VOLTAGE and REGULATOR_EVENT_OVER_CURRENT - are OR'd together before the worker fires, producing a combined bitmask. The regulator core's regulator_handle_critical() function evaluates the event parameter via a strict switch statement that only matches individual, single-bit event values; the combined bitmask matches no case, the 'reason' variable remains NULL, and hw_protection_trigger() is never called. No CWE is formally assigned; the root cause most closely resembles CWE-697 (Incorrect Comparison) combined with CWE-691 (Insufficient Control Flow Management). CPE cpe:2.3:a:linux:linux:* confirms applicability across Linux kernel builds where the pmbus driver is present and PMBus hardware is attached.