Skip to main content

Linux Kernel EUVDEUVD-2026-59296

| CVE-2026-72397 HIGH
2026-08-15 Linux GHSA-xrxg-rjqm-5pr4
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
7.1 HIGH

Local write to hwmon sysfs requires low-privilege shell access (PR:L, AV:L); no confidentiality leak; high integrity and availability from wrong voltage delivery.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:04 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.1
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()

pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the vrm_version configured by the driver, while pmbus_reg2data_vid() already switched on it. Any driver that selects a non-VR11 VID mode and exposes a regulator (or hwmon vout setter) sent dangerously wrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the chip interprets as 1080 mV.

Mirror pmbus_reg2data_vid() so writes round-trip with reads.

AnalysisAI

Incorrect VID encoding in the Linux kernel PMBus hwmon driver causes dangerously wrong voltage commands to be written to PMBus power management chips when non-VR11 VID modes are configured. The function pmbus_data2reg_vid() hardcoded VR11 encoding for writes while pmbus_reg2data_vid() correctly honored the driver-configured vrm_version for reads, creating an asymmetry that sends incorrect PMBUS_VOUT_COMMAND values - for example, a request for 200 mV on a VR12/VR13-mode device results in 1080 mV being delivered instead. No public exploit has been identified at time of analysis, and EPSS probability is 0.20% (10th percentile), reflecting the niche hardware and configuration requirements.

Technical ContextAI

PMBus (Power Management Bus) is an I2C-based protocol for digital power management in server and embedded hardware. The Linux kernel hwmon subsystem's PMBus core driver (drivers/hwmon/pmbus/pmbus_core.c) handles voltage output regulation via VID (Voltage Identifier) encoding tables that differ across standards: VR11, VR12, VR13, and IMVP9. The bug is a classic read/write asymmetry: pmbus_reg2data_vid() (register-to-data, i.e., reads) already performed a switch(data->vrm_version) dispatch, while pmbus_data2reg_vid() (data-to-register, i.e., writes) was hardcoded to VR11 encoding only. Drivers such as the Nvidia PMBUS driver that configure vrm_version to a non-VR11 mode and expose a voltage regulator or hwmon vout setter would encode output voltage targets using the wrong lookup table, producing values that the chip interprets as far higher voltages than intended. The fix mirrors the read path logic into the write path to ensure round-trip consistency. CWE is not formally assigned, but this is functionally a CWE-697 (Incorrect Comparison) or CWE-682 (Incorrect Calculation) - an incorrect encoding table selection leading to wrong output values.

RemediationAI

The primary fix is to upgrade to Linux kernel 7.1.5 (stable) or 7.2-rc2 (mainline), which contain the corrected pmbus_data2reg_vid() implementation. Distributions should backport commits 5bd0d47640395f8a8c34446b62d1781b88869dfa and 828cd614e2af053ca5e1d6da767bbd8a1b5cabfb from the stable kernel tree at https://git.kernel.org/stable/. For systems where patching is not immediately possible: restrict write access to hwmon sysfs voltage output attributes (typically under /sys/class/hwmon/hwmonX/) via DAC permissions or udev rules to prevent unprivileged users from issuing PMBUS_VOUT_COMMAND writes; note this does not prevent root-privileged exploitation. Additionally, disable any userspace voltage control daemons (e.g., power management agents) that interact with PMBus voltage regulators until the patch is applied, accepting the trade-off of losing dynamic voltage scaling. Systems without PMBus VID-capable hardware or drivers using VR11 mode exclusively are not functionally affected.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59296 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy