Linux kernel PMBus hwmon: type confusion in the alert path reads past the attribute allocation

UnscoredCVE-2026-74711Firmware, BMC & network fabriccurated

Impact

pmbus_notify() casts every attribute in the group to struct sensor_device_attribute and reads ->index, but the group also holds pmbus_samples_reg and pmbus_sensor objects that only embed a base device_attribute. For pmbus_samples_reg the index read runs past the end of the allocation, a slab out-of-bounds read; for pmbus_sensor the index overlaps page, phase and reg, so a garbage mask can spuriously match during an alert. This is the driver that reads PSU, VRM and hot-swap controller telemetry on high-power GPU chassis, so the practical consequences are a KASAN splat or bogus power-event notifications rather than a tenant-reachable compromise. No attacker path from a workload is established by the record.

Who can reach it

Not reachable from the network or from a tenant workload. The path runs when a PMBus device on the node's I2C/SMBus raises an alert, on a host that has the pmbus hwmon drivers loaded; influencing it deliberately means control of that bus, which is physical access.

What to do

Pick up a stable kernel with the fix at the next scheduled kernel roll and reboot the node - there is no separate vendor advisory and no live-patch path for this. Nodes that do not load pmbus hwmon drivers have no exposure, which is worth checking before it drives any maintenance window of its own.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-74711 https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5 https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4 https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.