SB20260815318 - Improper handling of exceptional conditions in Linux kernel hwmon pmbus driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72395)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass hardware protection handling.

The vulnerability exists due to improper exception handling in the pmbus regulator event notification worker when processing combined regulator fault events. A local privileged user can trigger multiple distinct regulator events before the worker runs to bypass hardware protection handling.

The issue occurs because combined event bitmasks are passed unmodified to the regulator core, where strict event handling can leave the fault reason unset.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f
• https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a
• https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf
• https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047
• https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba