SB20261007167 - Out-of-bounds write in Linux kernel hwmon pmbus driver
Published: October 7, 2026
Security Bulletin ID
SB20261007167
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds write (CVE-ID: CVE-2026-98199)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to out-of-bounds writes in the PMBus core when probing chips with more than 10 phases per page. A local user can trigger probing of an affected chip to corrupt kernel memory.
The mp2975 driver supports up to 14 phases per page, and the mp2856 driver supports up to 12 phases per page.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/06bd6794b5fd2163880ac3bfe973d4cc61f359f3
- https://git.kernel.org/stable/c/1ec644c94466834f8cb6b7ba12636fd047bdfdda
- https://git.kernel.org/stable/c/272006a52cbd9c8342cead4d3eb9221ebbe8b985
- https://git.kernel.org/stable/c/66368f682a53f3a3842e20eebb571a59809c52c0
- https://git.kernel.org/stable/c/9558fc1e042ac6b12dd63c37d2c51be4ec86d402
- https://git.kernel.org/stable/c/b32607710a20ad983f9fe4a3051892584c0641a4
- https://git.kernel.org/stable/c/b49f100a15b8876deccf8c59f41af92b8e25fd74