Executive brief
The Linux kernel's power management bus (pmbus) driver used incorrect voltage encoding when setting regulator output voltage commands. A driver configured to use non-VR11 voltage modes would send dangerously wrong voltage codes to power supply chips—for example, requesting 200 mV could result in the chip receiving a command for 1080 mV instead. This could cause hardware instability, device damage, or system failure.
Technical details
The vulnerability is a logic error in the pmbus_data2reg_vid() function in drivers/hwmon/pmbus/pmbus_core.c. The function hardcoded VR11 voltage encoding regardless of the vrm_version configured by the driver, while the corresponding read function (pmbus_reg2data_vid()) correctly switched on vrm_version. This caused writes to fail round-trip with reads. Any pmbus driver using VR12, VR13, IMVP9, AMD625mV, or NVIDIA195mV modes and exposing a hwmon vout setter would send incorrect PMBUS_VOUT_COMMAND codes. The fix adds a switch statement to pmbus_data2reg_vid() mirroring the logic in pmbus_reg2data_vid(), ensuring correct encoding for all supported VRM versions. No authentication or user interaction is required; exploitation occurs through normal hwmon regulator control.
Affected products
- Linux Linux kernel Multiple versions affected; patched in stable branches (commit 828cd614e2af053ca5e1d6da767bbd8a1b5cabfb and backported to linux-4.14.y, linux-4.19.y, linux-5.4.y, linux-5.10.y, linux-5.15.y, linux-6.1.y and later
Timeline
- 2026-06-20: other: Patch authored by Abdurrahman Hussain
- 2026-06-29: patched: Upstream commit 828cd614e2af053ca5e1d6da767bbd8a1b5cabfb merged
- 2026-07-24: patched: Backported to stable kernel branches
- 2026-08-15: disclosed: Published as CVE-2026-72397