CVE-2026-74711

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (pmbus) Fix type confusion in notification logic<br /> <br /> Sashiko reports:<br /> <br /> At the start of the loop in pmbus_notify(), the code unconditionally casts<br /> every attribute to a struct sensor_device_attribute:<br /> <br /> drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {<br /> for (i = 0; i num_attributes; i++) {<br /> struct device_attribute *da = to_dev_attr(data-&gt;group.attrs[i]);<br /> struct sensor_device_attribute *attr = to_sensor_dev_attr(da);<br /> int index = attr-&gt;index;<br /> ...<br /> }<br /> <br /> However, data-&gt;group.attrs can contain other types like struct<br /> pmbus_samples_reg or struct pmbus_sensor, which only embed a base<br /> struct device_attribute.<br /> <br /> If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting<br /> it to struct sensor_device_attribute and reading the index field appears<br /> to access memory past the end of the allocation, which might trigger a<br /> slab-out-of-bounds read.<br /> <br /> Additionally, if da is a struct pmbus_sensor, casting it causes the index<br /> field to overlap with the page, phase, and reg fields. Could this produce<br /> a garbage mask on little-endian systems that spuriously matches the target<br /> reg, page, and flags during an alert?<br /> <br /> Fix the problem by using struct sensor_device_attr in struct pmbus_sensor<br /> and struct pmbus_label. Since those attributes never trigger a<br /> notification, set the value of attr-&gt;index to -1 for them. Use this value<br /> to distinguish from boolean attributes which _can_ trigger a notification<br /> and use the index field to encode mask, page, and register values.