CVE-2026-80745 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
regulator: fp9931: Fix VPOS/VNEG voltage selector table
The VPOSNEG_table[] mapping does not match the FP9931 datasheet.
The datasheet defines the VPOS/VNEG voltage mapping as:
00h-04h -> 7.04V (-7.04V) 05h -> 7.26V (-7.26V) 06h -> 7.49V (-7.49V) ... 28h-3Fh -> 15.06V (-15.06V)
However, VPOSNEG_table[] has two issues:
1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the table has 6 entries of 7.04V, causing all subsequent entries to be shifted by one position.
2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but the table has only 41 entries. Any selector value above 0x28 would result in an out-of-bounds table access.
Fix both issues by removing the duplicate 7.04V entry and appending the missing 23 clamped 15.06V entries, bringing the table to the correct size of 64 entries (0x00~0x3F).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in the Linux kernel regulator driver for the FP9931 power management integrated circuit stems from a critical misalignment between the software implementation and the hardware specification. This issue is classified under CWE-824, which addresses access to an uninitialized or incorrect resource, specifically manifesting here as an out-of-bounds array access due to an incorrectly sized lookup table. The FP9931 driver utilizes a static array named VPOSNEG_table[] to map voltage selector codes from the hardware register to actual voltage values for positive and negative rails. This mapping is fundamental for ensuring that power supplies are configured within safe operational limits defined by the manufacturer's datasheet.
The technical flaw consists of two distinct errors in the definition of this lookup table. First, the initial segment of the table incorrectly contains six entries mapped to 7.04V, whereas the FP9931 datasheet specifies that selector values from hexadecimal 0x00 through 0x04 should map to this voltage level. This results in five valid entries rather than six, creating a shift where subsequent voltage levels are offset by one position relative to their intended hardware selectors. Second, and more critically, the table fails to account for the clamping behavior defined in the datasheet for higher selector values. The specification dictates that any selector from 0x29 through 0x3F should clamp to a maximum of 15.06V. However, the original implementation only provided entries up to index 0x28, resulting in a table size of forty-one elements instead of the required sixty-four.
The operational impact of this vulnerability is severe due to the potential for out-of-bounds memory access. When the kernel attempts to retrieve a voltage value using a selector code greater than or equal to 0x29, it accesses memory beyond the allocated bounds of the VPOSNEG_table[] array. In C-based systems like the Linux kernel, such an out-of-bounds read can lead to undefined behavior, including data corruption, kernel panics, or potentially exploitable conditions if adjacent memory structures contain sensitive information that is leaked through the incorrect voltage value returned to user space or other kernel subsystems. This represents a significant stability and security risk for systems relying on this specific regulator driver.
To mitigate this vulnerability, the fix involves correcting the VPOSNEG_table[] array by removing the duplicate 7.04V entry at the beginning of the table and appending twenty-three additional entries set to 15.06V to cover the range from selector 0x29 to 0x3F. This adjustment ensures the table contains exactly sixty-four entries, aligning perfectly with the eight-bit width of the voltage selector register in the FP9931 hardware. By restoring the correct mapping and preventing out-of-bounds access, the driver now adheres to the CWE-824 remediation standards for proper resource initialization and bounds checking. System administrators should ensure that kernel updates incorporating this patch are applied promptly to maintain system integrity and prevent potential exploitation of memory safety violations in power management subsystems.