CVEvulnerability
CVE-2026-72397
7.1 HIGH
Official page ↗
- Status
- Received
- Published
- 2026-08-15
- Last modified
- 2026-10-21
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- CVSS 3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
- 7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the
vrm_version configured by the driver, while pmbus_reg2data_vid()
already switched on it. Any driver that selects a non-VR11 VID mode
and exposes a regulator (or hwmon vout setter) sent dangerously
wrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked
for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the
chip interprets as 1080 mV.
Mirror pmbus_reg2data_vid() so writes round-trip with reads.
References
- https://git.kernel.org/stable/c/125a5a4ad03c74ced4c2a55db45ef03505362ff9 git.kernel.org
- https://git.kernel.org/stable/c/5bd0d47640395f8a8c34446b62d1781b88869dfa git.kernel.org
- https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb git.kernel.org
- https://git.kernel.org/stable/c/cd0e037130806d7714c356eccefac6e1b92dbc34 git.kernel.org