Executive brief
The Linux kernel's LTC4282 hardware monitoring driver contains an integer handling bug in its current limit setting code. When a negative current value is supplied to the driver, it is incorrectly converted to a very large positive number, causing the driver to set incorrect current limits. This could allow a local user with hardware monitoring access to bypass intended safety limits on power delivery hardware.
Technical details
The vulnerability is an integer underflow/overflow issue in the ltc4282_write_curr() function within drivers/hwmon/ltc4282.c. When a negative signed long value is passed to the function, it is directly cast to u64, converting negative inputs into large positive values due to two's complement representation. The subsequent arithmetic operation overflows a 32-bit variable, truncating to a pseudo-random positive value that is then clamped to the maximum allowed limit instead of zero. The fix involves clamping the input value to the valid range (0 to a calculated upper limit) before performing the cast and arithmetic operations, preventing the underflow and overflow conditions.
Affected products
- Linux Linux kernel All versions containing the LTC4282 hwmon driver (since introduction in commit cbc29538dbf7d)
Timeline
- 2026-08-22: disclosed: Published on NVD
- 2026-08-19: patched: Fix committed to stable kernel trees