Executive brief
The Linux kernel's power management bus (pmbus) driver incorrectly processes hardware fault events when multiple simultaneous power supply faults occur. When faults like under-voltage and over-current happen at nearly the same time, the driver fails to trigger critical hardware protection mechanisms, potentially allowing the system to continue operating despite dangerous electrical conditions.
Technical details
The vulnerability is a logic error in the pmbus regulator notification worker thread. A previous commit introduced event batching using atomic_or() to combine multiple faults into a bitmask before notifying the regulator core. However, the regulator subsystem's regulator_handle_critical() function uses a strict switch statement expecting individual event bits, not combined bitmasks. When multiple distinct faults are OR'd together (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined value fails to match any case in the switch statement, causing the critical hw_protection_trigger() handler to be bypassed entirely. The fix processes events one bit at a time, calling regulator_notifier_call_chain() separately for each individual fault flag so they are properly handled by the regulator core.
Affected products
- Linux Linux kernel from v5.10 (when commit 754bd2b4a084 was merged) through approximately v6.9 (prior to the fix)
Timeline
- 2026-08-15: disclosed: Publicly disclosed via NVD
- 2026-06-29: patched: Fix authored by Guenter Roeck on 2026-06-29