Executive brief
A vulnerability in the Linux kernel's hardware monitoring driver for certain Texas Instruments voltage regulators could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue occurs when the system attempts to identify the hardware chip and receives an unexpected empty response, leading to an improper memory read. This affects systems using specific power management controllers in their hardware configuration.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the tps53679_identify_chip() function within drivers/hwmon/pmbus/tps53679.c. The function calls i2c_smbus_read_block_data(), which can return 0 to indicate a zero-length read. The driver previously only checked for negative error codes (ret < 0); when ret is 0, the code subsequently accesses buf[ret - 1], resulting in a stack-based OOB read at buf[-1]. This can be triggered by a local user with sufficient privileges to interact with the i2c/hwmon interface. The fix updates the error validation to 'ret <= 0' to properly handle zero-length reads as an error condition.
Affected products
- Linux Linux Kernel 6.17.1 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-29: patched: Initial patch submitted to kernel mailing lists.
- 2026-05-01: disclosed: CVE-2026-43005 published.
- 2026-05-12: advisory: NIST/NVD analysis completed.