Linux kernel ltc4282 hwmon driver: out-of-bounds read reading the VGPIO minimum alarm voltage

Impact

The LTC4282 is a 12V hot-swap and power-monitor controller found on server and OCP-style boards, so this driver is loaded on some rack hardware rather than only on embedded boards. A missing return statement let the VGPIO channel's minimum-alarm-voltage path fall through into an out-of-bounds array access, found by static analysis rather than in the field. The realistic exposure is a small in-kernel read past a bounds check surfacing through a hwmon sysfs value, or a crash on that node; there is no public exploit and no remote path. Treat it as hygiene on affected hardware, not an emergency - but note that hwmon values are exactly what a fleet's power telemetry agent polls, so the path is exercised routinely.

Who can reach it

Local only. A user or agent on the node that can read the ltc4282 hwmon sysfs attributes; on most fleets those are root- or telemetry-user-readable. Applies only to machines carrying an LTC4282 with the driver bound - if the driver is not loaded, the node is not affected.

What to do

Fixed in the stable kernels carrying the linked commits; the advisory record lists commits rather than a single version, so pin the fix from the stable branch you track. Applying it means a kernel update and a reboot of each affected node unless you have livepatching that covers it. Check first whether ltc4282 is even loaded on your hardware - on fleets where it is not, this can wait for the normal kernel cadence.

References

Related entries

• Linux kernel SMC: use-after-free when a splice reader releases RMB pages during concurrent socket closeCVE-2026-80982 · Linux kernel net/smc (smc_rx_pipe_buf_release, RMB splice path)High
• Windows Update Stack: link following lets a local user escalate to SYSTEMCVE-2026-81963 · Windows Update Stack (link following during update servicing)High
• Windows ALPC: heap overflow gives a local user privilege escalation to SYSTEMCVE-2026-85880 · Windows ALPC (Advanced Local Procedure Call)High
• Linux kernel sunrpc: use-gss-proxy proc entry published before its mutex is initializedCVE-2026-89540 · Linux kernel sunrpc/auth_rpcgss (use-gss-proxy procfs entry, gssp_lock init ordering)High
• Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dumpCVE-2026-89690 · Linux kernel nfsd (nfsd4_release_compoundargs / rpc_status netlink dump)High
• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High