Linux kernel ltc4282 hwmon driver: out-of-bounds read reading the VGPIO minimum alarm voltage

Impact

The LTC4282 is a 12V hot-swap and power-monitor controller found on server and OCP-style boards, so this driver is loaded on some rack hardware rather than only on embedded boards. A missing return statement let the VGPIO channel's minimum-alarm-voltage path fall through into an out-of-bounds array access, found by static analysis rather than in the field. The realistic exposure is a small in-kernel read past a bounds check surfacing through a hwmon sysfs value, or a crash on that node; there is no public exploit and no remote path. Treat it as hygiene on affected hardware, not an emergency - but note that hwmon values are exactly what a fleet's power telemetry agent polls, so the path is exercised routinely.

Who can reach it

Local only. A user or agent on the node that can read the ltc4282 hwmon sysfs attributes; on most fleets those are root- or telemetry-user-readable. Applies only to machines carrying an LTC4282 with the driver bound - if the driver is not loaded, the node is not affected.

What to do

Fixed in the stable kernels carrying the linked commits; the advisory record lists commits rather than a single version, so pin the fix from the stable branch you track. Applying it means a kernel update and a reboot of each affected node unless you have livepatching that covers it. Check first whether ltc4282 is even loaded on your hardware - on fleets where it is not, this can wait for the normal kernel cadence.

References

Related entries

• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High
• Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theCVE-2021-47130 · Linux kernel (drivers/nvme/target)High