Type Confusion Vulnerability in Linux Kernel hwmon Driver by The Linux Foundation

CVE-2026-74711

What is CVE-2026-74711?

A type confusion vulnerability exists in the hwmon driver of the Linux kernel, specifically within the notification logic of the PMBus interface. The vulnerability arises due to improper casting of device attributes, leading to potential slab-out-of-bounds memory reads. When attributes from the PMBus data group are not correctly identified as sensor_device_attribute, this may allow out-of-bounds access. The risk includes the possibility of retrieving nonsensical data or triggering unwanted alerts due to overlapping memory fields on little-endian systems. This issue can undermine system integrity and may facilitate exploitation in certain conditions, warranting swift attention and rectification.

References