SB20260928390 - Out-of-bounds read in Linux kernel hwmon driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-97538)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose uninitialized bytes through sensor values exposed via sysfs.

The vulnerability exists due to an out-of-bounds read in the rog_ryujin_raw_event() function of the ASUS ROG Ryujin hwmon driver when processing a short HID report. An attacker with physical access can provide a short HID report to disclose uninitialized bytes through sensor values exposed via sysfs.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1caa5f9399ff107a8fa221b1eaca0a9e729d3758
• https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481