Executive brief
A vulnerability was identified in the Linux kernel's POWER-Z hardware monitoring driver. On certain computer architectures, the driver's data buffer could accidentally share memory space with other internal controls, potentially leading to data corruption or system instability during hardware monitoring operations. This issue has been resolved in recent kernel updates.
Technical details
A vulnerability in the Linux kernel's POWER-Z (hwmon) driver stems from improper DMA buffer alignment. In the 'powerz_priv' structure, the 'transfer_buffer' could share a cacheline with the subsequent 'mutex' member depending on the CPU architecture. Because the buffer is used for Direct Memory Access (DMA), this cacheline sharing can lead to cache coherency issues or memory corruption when the hardware and CPU attempt to access the same cacheline simultaneously. The fix involves using high-level DMA helpers (__dma_from_device_group_begin/end) to ensure the buffer is properly isolated in its own cacheline. This is primarily a local stability and integrity issue.
Affected products
- Linux Linux Kernel POWER-Z driver (hwmon)
Timeline
- 2026-04-08: disclosed: Initial patch submission
- 2026-05-27: advisory: CVE published by kernel.org and NVD