Linux Kernel EUVD-2026-64398

Exploitation requires two concurrent prerequisites: (1) the target system must have a PMBus-capable power management IC present and the pmbus / pmbus_core kernel modules must be loaded and actively managing that hardware; and (2) the PMBus device must generate an alert interrupt that invokes pmbus_notify(), which can be triggered by hardware fault conditions (over-temperature, over-current, under-voltage). These conditions together mean the vulnerability is entirely unreachable on systems without PMBus hardware - including most consumer laptops, desktops, and VMs. The NVD-assigned PR:N is potentially misleading: while no kernel-level privilege is needed once the hardware alert fires, the hardware dependency itself constitutes a significant access constraint. Exploitation is further limited to local access (AV:L) with no network-based attack path. The slab-out-of-bounds read is only in kernel context (ring 0), requiring the attacker to leverage it via a kernel exploitation technique to achieve privilege escalation.

The NVD CVSS 3.1 score of 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H warrants scrutiny. The PR:N (no privileges) claim is inconsistent with the exploitation path: triggering pmbus_notify() requires a PMBus hardware alert interrupt, which presupposes physical or privileged hardware access - an unprivileged local user on a system without PMBus-capable hardware cannot trigger this path at all. AC:L also appears generous given the hardware dependency. EPSS at 0.21% (11th percentile) aligns with the assessment that real-world exploitation is constrained: the vulnerability affects a niche kernel subsystem only present in enterprise server or embedded environments with specific PMBus power management ICs. Neither CISA KEV listing nor public exploit code has been identified. The gap between the theoretical CVSS score and the practical EPSS signal is notable - this is a high-CVSS-but-low-immediate-real-risk issue for most deployments. For environments with PMBus hardware (data centers, embedded power management systems), the risk is elevated because kernel-level memory corruption carries escalation potential. The PR:N/AC:L assignment from NVD should be independently verified against the hardware trigger requirement.

An attacker with local access on a server equipped with a PMBus-capable power management IC (common in rack-mounted servers with intelligent PSUs) waits for or induces a PMBus hardware alert interrupt - for example, by stressing the power rail to trigger an over-current or over-temperature alert from the PMBus device. When the kernel's pmbus_notify() fires in response, the type confusion causes a slab-out-of-bounds read or corrupts kernel memory via the garbage mask collision, potentially enabling a privilege escalation from a local unprivileged user to root. No public proof-of-concept exploit exists at time of analysis.