CVE-2026-74711 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus) Fix type confusion in notification logic
Sashiko reports:
At the start of the loop in pmbus_notify(), the code unconditionally casts every attribute to a struct sensor_device_attribute:
drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {
for (i = 0; i < data->num_attributes; i++) {
struct device_attribute *da = to_dev_attr(data->group.attrs[i]);
struct sensor_device_attribute *attr = to_sensor_dev_attr(da); int index = attr->index; ... }
However, data->group.attrs can contain other types like struct pmbus_samples_reg or struct pmbus_sensor, which only embed a base struct device_attribute.
If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting it to struct sensor_device_attribute and reading the index field appears to access memory past the end of the allocation, which might trigger a slab-out-of-bounds read.
Additionally, if da is a struct pmbus_sensor, casting it causes the index field to overlap with the page, phase, and reg fields. Could this produce a garbage mask on little-endian systems that spuriously matches the target reg, page, and flags during an alert?
Fix the problem by using struct sensor_device_attr in struct pmbus_sensor and struct pmbus_label. Since those attributes never trigger a notification, set the value of attr->index to -1 for them. Use this value to distinguish from boolean attributes which _can_ trigger a notification and use the index field to encode mask, page, and register values.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel hardware monitoring subsystem contains a critical type confusion vulnerability within the pmbus_notify function located in drivers/hwmon/pmbus/pmbus_core.c. This flaw arises from an unsafe assumption regarding data structure types during attribute iteration. Specifically, the notification logic unconditionally casts every element within the device attribute group to a struct sensor_device_attribute pointer using the to_sensor_dev_attr macro. While this cast is valid for certain attributes that are indeed instances of sensor_device_attribute, it fails when applied to other structures such as struct pmbus_samples_reg or struct pmbus_sensor. These alternative structures embed a base struct device_attribute but do not share the same memory layout or field definitions as sensor_device_attribute, leading to severe memory safety violations and logic errors during runtime execution.
The primary technical consequence of this type confusion is a slab-out-of-bounds read vulnerability. When the code processes an attribute that is actually a struct pmbus_samples_reg, it interprets the memory starting at the device_attribute member as if it were a sensor_device_attribute structure. Since index is not the first field in these alternative structures and may reside beyond the allocated bounds of the object when viewed through the wrong type lens, accessing attr->index results in reading arbitrary kernel memory adjacent to the original allocation. This constitutes an out-of-bounds read that can potentially leak sensitive kernel information or cause a system crash if the accessed memory is unmapped or protected. Furthermore, for struct pmbus_sensor instances, casting causes the index field to overlap with fields such as page, phase, and reg. On little-endian systems, this misinterpretation generates garbage values that may spuriously match target register masks, pages, or flags during alert processing, leading to incorrect hardware monitoring behavior and potential false positives in thermal or voltage alerts.
From a security classification perspective, this vulnerability aligns with CWE-843, Access of Resource Using Incompatible Type, as the code accesses memory using an incompatible data type that does not match its actual definition. Additionally, it relates to CWE-120, Buffer Copy without Checking Size of Input, insofar as the improper casting leads to reading beyond allocated boundaries. The operational impact includes potential denial of service through kernel panics caused by invalid memory access, information disclosure via leakage of adjacent kernel stack or heap data, and integrity issues due to incorrect handling of hardware sensor alerts which could mask real faults or trigger unnecessary system interventions.
To mitigate this vulnerability, the fix involves restructuring how attributes are handled within the pmbus driver logic. The solution requires using struct sensor_device_attr for structures like struct pmbus_sensor and struct pmbus_label, ensuring type consistency throughout the notification process. Crucially, since these specific attribute types do not trigger notifications, their index field is set to -1 as a sentinel value. This allows the code to explicitly distinguish between boolean attributes that can trigger notifications and use the index field for encoding mask, page, and register values only when appropriate. Developers should ensure strict type checking before casting generic device attributes to specific sensor attribute types in kernel subsystems handling hardware monitoring data. Regular static analysis tools configured to detect incompatible pointer casts and out-of-bounds accesses are recommended to prevent similar issues in future development cycles.