Linux Kernel EUVD-2026-59296

Exploitation requires three concurrent conditions: (1) the system must have PMBus-connected power management hardware with a voltage regulator driver that configures vrm_version to a non-VR11 mode (e.g., VR12, VR13, or IMVP9) - drivers using the default VR11 encoding are unaffected; (2) that driver must expose a voltage output setter via the Linux regulator framework or hwmon sysfs; and (3) the attacker must have local shell access with at least low privileges (PR:L per CVSS) sufficient to write to the hwmon or regulator interface. The wrong-voltage behavior is passive and triggered by any voltage write operation - it does not require a crafted exploit payload, only normal usage on the affected configuration. This substantially limits the attack surface to server and embedded platforms with specific Nvidia, or similar, PMBUS VRM hardware running affected kernel versions.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) scores 7.1 and accurately reflects the local, low-privilege access model. In practice, this is an integrity and availability vulnerability against specific hardware: a system must run Linux with a PMBus driver that (a) configures a non-VR11 VID mode and (b) exposes the voltage regulator or hwmon sysfs interface for writes. The EPSS of 0.20% at the 10th percentile correctly reflects that exploitation requires both specialized hardware and the ability to write to hwmon interfaces, which is uncommon outside server and embedded power-management contexts. There is no KEV listing and no public exploit, confirming this is not a broadly targeted issue. The real-world risk is concentrated in server platforms using VR12/VR13/IMVP9-capable PMBus voltage regulators - the danger is physical: an attacker or misconfigured userspace process could command the VRM to deliver significantly higher voltage than intended, potentially causing hardware damage or system reset. The absence of a confidentiality impact is consistent with the description. The high integrity and availability scores are appropriate given the potential for irreversible hardware damage.

A low-privileged local user on a server equipped with a PMBus voltage regulator operating in VR12 or VR13 VID mode writes a target voltage (e.g., 200 mV) to the hwmon sysfs vout attribute. The kernel encodes this using the hardcoded VR11 table rather than the correct VR12/VR13 table, clamping and re-encoding the value to a register byte (e.g., 0xB2) that the chip interprets as 1080 mV - more than five times the intended voltage. The VRM delivers this dangerously elevated voltage to the CPU or memory subsystem, potentially causing an immediate system crash or permanent hardware damage. No public proof-of-concept exists; exploitation requires both targeted hardware knowledge and local write access to the relevant sysfs interface.