CVE-2026-98199 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/core) increase number of phases and add new mask
Increase the number of phases to 16 as a new upcoming device supports such a number.
While at it, add a new mask for controlling the source of the output voltage.
Note (groeck):
This patch was meant to prepare for support of MAX20826 and compatible devices, which support more than 10 phases per page. However, Sashiko reports that the mp2975 driver already supports up to 14 phases, and the mp2856 driver supports up to 12 phases. This already has the potential for out-of-bounds writes when probing the affected chips, making this patch a bug fix.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel's hardware monitoring subsystem contains a critical flaw within the PMBus core implementation that allows for out-of-bounds memory access during device initialization and operation. This vulnerability stems from insufficient validation of phase count parameters when interacting with power management integrated circuits, specifically those utilizing the PMBus protocol. The underlying issue arises because certain drivers previously assumed a lower maximum number of phases than what is technically supported by modern hardware devices. When probing chips that support more phases than the kernel's internal structures were designed to handle, the system attempts to write data beyond the allocated buffer boundaries. This constitutes an out-of-bounds write vulnerability, which falls under CWE-787: Out-of-Bounds Write in standard classification systems.
The technical root cause involves a mismatch between the static array sizes defined in the PMBus core and the dynamic phase counts reported by specific hardware devices such as the MAX20826, MP2975, and MP2856 power controllers. These devices can report up to fourteen or sixteen phases per page during their initialization sequence. The kernel's existing implementation did not account for these higher values, leading to memory corruption when the driver attempts to populate phase-related data structures. This flaw is particularly dangerous because it occurs early in the device probing process, potentially allowing an attacker with local access to exploit this condition by triggering specific hardware interactions or manipulating device descriptors if such capabilities exist within the system's attack surface.
From a security perspective, out-of-bounds writes are severe vulnerabilities that can lead to arbitrary code execution, privilege escalation, or system crashes depending on how the corrupted memory is utilized. In the context of kernel-space operations, this type of flaw undermines the integrity and stability of the operating system. An attacker who can influence the hardware enumeration process or exploit a vulnerable driver could potentially overwrite adjacent kernel data structures, leading to control flow hijacking. This aligns with MITRE ATT&CK techniques related to privilege escalation and defense evasion through memory corruption exploits. The vulnerability highlights the risks associated with hardcoding limits in drivers without adequate bounds checking against actual device capabilities.
The resolution involves increasing the maximum number of phases supported by the PMBus core from its previous limit to sixteen, thereby accommodating devices like the MAX20826 that require this capacity. Additionally, a new mask was introduced to properly control the source of output voltage, ensuring correct configuration handling for these advanced power management units. This patch serves as both an enhancement for future hardware support and a critical bug fix for existing drivers such as mp2975 and mp2856, which already operate with phase counts that exceed the old limits. By expanding the internal arrays and adding appropriate masking logic, the kernel prevents illegal memory writes during device probing operations.
To mitigate this vulnerability in environments where patching is not immediately feasible, administrators should ensure that only trusted hardware components are connected to systems running affected kernel versions. Disabling unnecessary power management features or restricting access to hardware monitoring interfaces can reduce the attack surface. However, the definitive remediation requires applying the upstream Linux kernel update that incorporates these changes. Organizations must prioritize updating their kernel packages to include this fix, as it addresses a fundamental memory safety issue in core subsystems responsible for managing critical system resources like voltage regulators and power phases. Regular vulnerability scanning and patch management processes should be employed to detect and resolve such issues before they can be exploited by malicious actors seeking to compromise system integrity.