Linux Kernel EUVD-2026-24852

Exploitation requires local access with low privileges (CVSS AV:L/PR:L) and, critically, that the target actually has a PMBus-managed power device with the pmbus/pmbus_core hwmon driver loaded and exposing regulator operations - without that hardware and driver, the vulnerable pmbus_regulator_get_voltage/set_voltage/list_voltage paths are never reached. The race is triggered by concurrent regulator voltage operations coinciding with a regulator notification (e.g., a fault handler invoking pmbus_regulator_notify() while update_lock is held). Limiting factors: no remote vector, authenticated local access is needed, no confidentiality impact (C:N), and realistic exploitation depends on winning a timing window and on non-ubiquitous PMBus hardware being present, which sharply narrows the affected population.

The signals are internally consistent and point to a genuine-but-low-urgency defect. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1) requires local access and low privileges, with no confidentiality impact but high integrity and availability impact - matching a race that corrupts shared regulator/register state and can destabilize power management. EPSS is 0.02% (4th percentile), the vulnerability is NOT on CISA KEV, and no POC is referenced, so there is no evidence of exploitation. No SSVC decision was provided in the input. One notable tension: the input Tags list 'Information Disclosure', yet the CVSS vector explicitly sets C:N (no confidentiality impact) and the code change concerns locking/race conditions, not data leakage - the 'Information Disclosure' tag appears mislabeled and should not drive prioritization. Realistically this is a low-priority hardening fix: exploitation additionally requires the target system to actually have a PMBus-managed regulator device present and probed, which is uncommon outside specific server/embedded hardware. Patch quickly via normal kernel update cycles, but this does not warrant emergency response.

A local user with access to a system containing a PMBus-managed regulator concurrently drives the regulator's voltage get/set/list sysfs operations while the device generates fault notifications, racing the unserialized access to shared PMBus registers and per-page state. The resulting corruption or inconsistent register writes can misconfigure the regulator and destabilize power delivery or crash the subsystem (integrity/availability impact). No public exploit code is identified, and success depends on the presence of real PMBus hardware and precise timing given the local, low-privilege attack vector.