Executive brief
A vulnerability was identified in the Linux kernel's power management subsystem (PMBus) that could lead to system instability or unauthorized data modification. The affected component manages voltage regulators, and the lack of proper locking could allow concurrent operations to interfere with each other. This could result in a system crash or unpredictable hardware behavior in environments where power management is critical.
Technical details
A race condition exists in the Linux kernel's hwmon pmbus/core driver. The functions pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() accessed PMBus registers and shared data without acquiring the update_lock mutex. While adding the mutex directly would cause deadlocks during fault handling notifications, the fix reworks pmbus_regulator_notify() to use a worker function for out-of-band notifications. This allows the voltage functions to be properly protected by the mutex without risking a deadlock. The vulnerability is classified under CWE-667 (Improper Locking).
Affected products
- Linux Linux Kernel 3.19 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-04-22: disclosed
- 2026-04-22: advisory
- 2026-04-02: patched