Linux kernel hwmon/pmbus: combined fault bitmask bypasses the critical hardware-protection shutdown

Impact

The pmbus core batches regulator events with atomic_or() and hands the combined bitmask to regulator_notifier_call_chain(). regulator_handle_critical() matches the event with a strict switch, so when two distinct faults land in the same batch - for example under-voltage plus over-current - nothing matches, the reason stays NULL, and hw_protection_trigger() is never called. That is the emergency shutdown path for a power rail in trouble. On a GPU node, PMBus regulators and hot-swap controllers are exactly what report multiple simultaneous faults when a high-power rail fails, and the fix means the kernel will not take the protective action it was supposed to take. The exposure is availability and potential hardware damage during a real power event, not an attacker-driven compromise; it only applies to nodes whose power stage is monitored through pmbus hwmon with critical regulator protection configured.

Who can reach it

No remote attack path. Triggered by the hardware itself reporting two or more regulator faults within one batching window; a local user with access to the pmbus hwmon sysfs interface is the only software actor involved.

What to do

Take the stable kernel commits in the record (pass regulator events bit by bit) through a distribution kernel update, which requires draining and rebooting each affected node. No configuration mitigation exists; until patched, do not rely on kernel hardware protection alone for these rails - keep BMC and PSU-level power-fault alerting in place.

References

Related entries

• Arista EOS: malformed packets crash the IGMP snooping agent and flood multicast to the whole VLANCVE-2026-73462 · Arista EOS IGMP snooping agentHigh
• Arista EOS: crafted packet expires multicast forwarding state early, dropping multicast trafficCVE-2026-73468 · Arista EOS multicast forwarding stateHigh
• Dell OpenManage Enterprise: unauthenticated adjacent attacker steals a console sessionCVE-2026-91914 · Dell OpenManage Enterprise (authentication bypass by spoofing / session theft)High
• IBM Server Firmware: unauthenticated request crashes the ASMI management web serverCVE-2026-93306 · IBM Server Firmware (ASMI web interface)High
• HPE iLO 4 / iLO 5 (remote buffer overflow): Remotely triggerable buffer overflow in the iLO firmware on both the Gen9CVE-2019-11983 · HPE iLO 4 / iLO 5 (remote buffer overflow)High
• Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU): A buffer shared between SMM and non-SMM codeCVE-2022-32469 · Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU)High