Skip to main content

Linux Kernel EUVDEUVD-2026-59742

| CVE-2026-74549 HIGH
2026-08-15 Linux GHSA-8cf5-68w2-4vhx
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain low-privilege local shell on nct6116-equipped system
  2. Delivery
    nct6775 module loads and initializes nct6116 with pwm_num=5
  3. Exploit
    nct6775_update_pwm() iterates with has_pwm bits 3/4 set
  4. Install
    Out-of-bounds read from 3-element weight register arrays at index 3 or 4
  5. C2
    Garbage kernel memory value used as hardware I/O port address
  6. Execute
    Invalid hardware register read/write executed
  7. Impact
    Hardware misconfiguration or kernel panic

Vulnerability Assessment

Exploitation Conditions

Exploitation requires all of the following: (1) the target machine must physically contain a Nuvoton nct6116 Super I/O chip - this is a hardware-specific prerequisite that eliminates the vast majority of Linux deployments; (2) the nct6775 kernel module must be loaded and the nct6116 chip must be detected and initialized by the driver; (3) the data->has_pwm bitmask must have bit 3 or bit 4 set during driver initialization, enabling iteration over the out-of-bounds indices - this is 'structurally possible for nct6116' per the description but depends on chip configuration; (4) the attacker must have local system access with at least low privileges (CVSS PR:L). There is no network-exploitable path. Limiting factors beyond hardware specificity include the requirement for the driver to reach the vulnerable update path during normal operation, and the absence of any known exploit or triggering technique that can be reliably induced by an unprivileged user independent of hardware initialization state.
Impact

The NVD CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local attack surface and the severity of the combined out-of-bounds read plus invalid hardware register write, but overstates practical risk for most environments. EPSS at 0.17% (7th percentile) signals near-zero exploitation probability in the wild, consistent with the hardware-specific trigger: the nct6116 chip must be physically present and the has_pwm bitmask must have bits 3 or 4 set during initialization. The vulnerability is not listed in CISA KEV and no public proof-of-concept exploit has been identified. The CVSS attack vector (AV:L) is consistent with the description - exploitation requires local access, not a network path. No conflict between CVSS and description is detected. SSVC factors reinforce low urgency: exploitation is not automated, the affected population is constrained by specific hardware, and no active exploitation is confirmed. This warrants patching on next maintenance cycle, not emergency response.
Exploit ScenarioDerived

A local user with a low-privileged account on a desktop or server motherboard containing the Nuvoton nct6116 Super I/O chip boots the system with the nct6775 module loaded and has_pwm bits 3 or 4 set during initialization. When nct6775_update_pwm() executes, it reads indices 3 and 4 from the 3-element NCT6106 weight register arrays, obtaining arbitrary kernel memory values that are then passed as hardware I/O port addresses. The driver writes to these unintended I/O ports, potentially corrupting hardware state or triggering a kernel panic. No public proof-of-concept exploit has been identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.

RemediationAI

The primary fix is to upgrade to a patched kernel: Linux 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, available via the upstream stable tree at https://git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0 and related commits listed in the references. Distribution maintainers (Red Hat, Ubuntu, SUSE, Debian) are expected to backport these fixes; monitor vendor advisories accordingly. If kernel upgrade is not immediately feasible, a targeted workaround is to blacklist the nct6775 module by adding 'blacklist nct6775' to /etc/modprobe.d/nct6775-blacklist.conf and running 'dracut -f' (or equivalent initramfs rebuild), then rebooting. Trade-off: this disables all hardware monitoring (fan speed, temperature alerts) provided by the nct6116 chip, which may affect thermal management visibility. Do not unload the module on running systems where it controls active fan PWM, as this could disable fan speed regulation.

Affected VersionsENISA

Linux patch: 7.2-rc6
Linux patch: 6.18.44
Linux 29c7cb485b321c024dedc168bcbb04451176b163 <689082a4cb166a7ae9729f7b12339e69fdad6c52
Linux patch: 6.6.151
Linux 29c7cb485b321c024dedc168bcbb04451176b163 <25b528816f5d83be5236dc182692369e8c9402b0
Linux 5.4
Linux 29c7cb485b321c024dedc168bcbb04451176b163 <d0b704e569ac3b8416d8e02270cdc9bf830ed395
Linux patch: 6.12.103
Linux patch: 0
Linux 29c7cb485b321c024dedc168bcbb04451176b163 <4ad2972ef0e1bd1018ad7a72661a4636ed7daecc
Linux 29c7cb485b321c024dedc168bcbb04451176b163 <1b722740ac5c2b2070f9ba922f4e0f227faf0246
Linux patch: 7.1.8

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in drivers/hwmon/nct6775-core.c, part of the Linux kernel's hwmon subsystem. The nct6116 is a Nuvoton Super I/O chip that exposes hardware monitoring (fan speed, temperature, voltage, PWM control). During driver initialization, data->pwm_num is set to 5 (the chip supports five fan PWM channels), but the weight register arrays inherited from the NCT6106 register definitions - NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_* - contain only 3 elements, because only the first three channels support weight-based fan control. The function nct6775_update_pwm() iterates up to data->pwm_num without checking whether the weight register arrays are large enough to support that index, producing a global out-of-bounds read detectable by KASAN. The out-of-bounds memory contents are then passed as I/O port addresses for hardware read/write operations, escalating the impact well beyond a simple information leak. The tagged CWE is omitted in the input, but this is structurally CWE-125 (Out-of-bounds Read) compounded by CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The fix extends the arrays with zeroed entries, exploiting the existing driver convention of treating zero-value register addresses as 'not supported' and skipping them. The CPE identifier is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local driver path requires PR:L; out-of-bounds kernel read (C:H), invalid hardware register writes (I:H), and crash potential (A:H) are all grounded in the description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nct6775-core) Prevent access to unsupported weight registers

Sashiko reports:

During initialization of the nct6116 chip, the driver sets data->pwm_num to 5. However, it assigns several NCT6106 register arrays (such as NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP. These arrays only contain 3 elements.

In nct6775_update_pwm(), the driver iterates up to data->pwm_num. If data->has_pwm has bits 3 or 4 set (which is structurally possible for nct6116), the loop attempts to read elements at index 3 and 4 from these 3-element arrays. This results in a global out-of-bounds read, which can be caught by KASAN.

Furthermore, the driver uses these garbage out-of-bounds values as hardware register addresses for subsequent read and write operations. This leads to invalid hardware register access, potentially causing hardware misconfiguration or system crashes.

The underlying problem is that the chip does support up to five fan control channels, but only the first three support weight control. Fix the problem by extending the affected weight register arrays with zeroed fields. The driver uses zeroed register addresses to determine if a register is supported or not, and skips accesses for unsupported registers.

Executive ViewAI

Why It Matters

CVE-2026-74549 affects Linux kernel systems equipped with nct6116 Super I/O chipsets, creating a risk of system crashes and hardware misconfiguration through local exploitation. The vulnerability carries a high technical severity score (CVSS 7.8) but extremely low exploitation likelihood (0.2% EPSS), with no public exploits identified. Organizations should patch affected systems during routine maintenance cycles while allocating greater security resources to vulnerabilities with higher exploitation probability.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Low
nct6116 Super I/O chip present only in specific desktop and server motherboards
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74549 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/390864 REF https://git.kernel.org/stable/c/0d11b2a10269ace29832f584d207ff3768f79dc5 REF https://git.kernel.org/stable/c/1b722740ac5c2b2070f9ba922f4e0f227faf0246 REF https://git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0 REF https://git.kernel.org/stable/c/4a77f1d72c6db04cbbfab0250292ac71fdea5f0a REF https://git.kernel.org/stable/c/4ad2972ef0e1bd1018ad7a72661a4636ed7daecc REF https://git.kernel.org/stable/c/513d847f7a95bbdbeaaf55fb942c38992587734f REF https://git.kernel.org/stable/c/689082a4cb166a7ae9729f7b12339e69fdad6c52 REF https://git.kernel.org/stable/c/d0b704e569ac3b8416d8e02270cdc9bf830ed395

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy