Executive brief
A vulnerability in the Linux kernel's POWER-Z hardware monitoring driver could allow the system to read uninitialized data when a USB communication process is interrupted. This occurs because the driver fails to properly cancel a pending data request if the process is stopped by a system signal. While primarily a technical stability issue, it could lead to unpredictable system behavior or the processing of invalid hardware sensor data.
Technical details
A vulnerability in the 'powerz' hwmon driver in the Linux kernel stems from improper handling of the return value from wait_for_completion_interruptible_timeout() in powerz_read_data(). When the function is interrupted by a signal, it returns -ERESTARTSYS. The original code only checked for a timeout (return value 0) and failed to call usb_kill_urb() on signal delivery. This allows the function to proceed and read from an unfilled transfer buffer. An attacker or local process could potentially trigger this by sending signals to a process interacting with the hardware monitor, leading to an information leak of uninitialized kernel memory or invalid sensor readings. The issue has been patched by ensuring usb_kill_urb() is called for both timeout and signal interrupt cases.
Affected products
- Linux Linux Kernel Fixed in 8b51277, b66437c, b6cb07f, d644587
Timeline
- 2026-04-10: patched: Initial patch submitted by Sanman Pradhan
- 2026-05-27: disclosed: CVE-2026-46073 published