Out-of-Bounds Read in Linux Kernel Affects nct6116 Chip

CVE-2026-74549

What is CVE-2026-74549?

The Linux kernel contains a vulnerability related to the nct6116 chip where the driver mismanages register access. This arises from an attempt to read registers beyond the valid range, specifically during the initialization of the chip. While the hardware can support up to five fan control channels, only three registers are valid for weight control. The problematic driver improperly handles arrays that lead to out-of-bounds reads, resulting in attempts to access invalid memory locations. This misconfiguration may result in unexpected behavior, including system instability or crashes. A recommended fix includes extending the weight register arrays with zeroed fields to ensure that unsupported registers are not accessed.

References