CVE-2026-72395

Received Received - Intake

Buffer Overflow in Linux Kernel hwmon PMBus Core

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator events over time using atomic_or(). The delayed worker then passes the combined bitmask unmodified to regulator_notifier_call_chain(). The core regulator subsystem's regulator_handle_critical() function evaluates the event parameter using a strict switch statement. If multiple distinct faults occur before the worker runs (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined bitmask fails to match any case. This leaves the reason as NULL and completely bypasses the critical hw_protection_trigger(). Fix the problem by passing events bit by bit to the regulator event handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72395

EUVD

EUVD-2026-59294

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the hwmon pmbus driver where regulator events are incorrectly batched and passed to the regulator core. The issue occurs because multiple distinct faults are combined into a single bitmask, which fails to match any case in the regulator subsystem's event handler. This bypasses critical protection mechanisms like hw_protection_trigger().

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem and pmbus driver. Detection requires checking kernel logs for hwmon or pmbus-related errors, particularly involving regulator events. Monitor dmesg or journalctl for messages about regulator events or hwmon failures.

Impact Analysis

This vulnerability could lead to unhandled hardware faults in systems using the affected Linux kernel. If multiple regulator faults occur simultaneously, the system may fail to detect or respond to critical conditions like under-voltage or over-current, potentially causing hardware damage or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a Linux kernel hardware monitoring subsystem issue that could lead to unhandled regulator faults, potentially causing system instability or hardware damage. Compliance impacts would only occur if such failures resulted in data loss or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If an update is not immediately available, consider disabling the affected hwmon or pmbus modules if they are not critical to system operation.

Hi! I’m here to help you understand CVE-2026-72395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70