Linux kernel PMBus hwmon: unlocked regulator voltage operations race with fault notifications

CVSS 7.1CVE-2026-31486Firmware, BMC & network fabriccurated

Impact

pmbus_regulator_get_voltage, set_voltage and list_voltage touched PMBus registers and shared driver state without holding update_lock, so they could race with the fault handler's notification path; the fix moves notification to a worker so the lock can be taken safely. PMBus is how the kernel reads and controls the digital power regulators and hot-swap controllers on server boards and PDUs, which is exactly the telemetry a GPU chassis relies on, so the plausible outcome is corrupted voltage reads or writes and unreliable power telemetry rather than a data leak. The record describes integrity and availability impact only and gives no evidence of a privilege boundary being crossed; exposure requires local access to the hwmon/regulator interfaces on a host whose board exposes a PMBus regulator.

Who can reach it

Local user able to drive the hwmon/regulator sysfs interfaces on a host with a PMBus regulator driver bound. No remote path; no exposure on platforms without PMBus regulators.

What to do

Take the stable kernel fix and reboot each affected node. There is no userspace mitigation beyond restricting write access to the regulator sysfs attributes; platforms with no PMBus regulator driver loaded are unaffected.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-31486 https://git.kernel.org/stable/c/2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07 https://git.kernel.org/stable/c/b26849cffaa7c43355b82e9bef3725e786973a1a

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.