CVE-2026-74549

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (nct6775-core) Prevent access to unsupported weight registers<br /> <br /> Sashiko reports:<br /> <br /> During initialization of the nct6116 chip, the driver sets data-&gt;pwm_num<br /> to 5. However, it assigns several NCT6106 register arrays (such as<br /> NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and<br /> NCT6106_REG_WEIGHT_TEMP_*) to data-&gt;REG_PWM and data-&gt;REG_WEIGHT_TEMP.<br /> These arrays only contain 3 elements.<br /> <br /> In nct6775_update_pwm(), the driver iterates up to data-&gt;pwm_num. If<br /> data-&gt;has_pwm has bits 3 or 4 set (which is structurally possible for<br /> nct6116), the loop attempts to read elements at index 3 and 4 from these<br /> 3-element arrays. This results in a global out-of-bounds read, which can<br /> be caught by KASAN.<br /> <br /> Furthermore, the driver uses these garbage out-of-bounds values as<br /> hardware register addresses for subsequent read and write operations. This<br /> leads to invalid hardware register access, potentially causing hardware<br /> misconfiguration or system crashes.<br /> <br /> The underlying problem is that the chip does support up to five fan<br /> control channels, but only the first three support weight control.<br /> Fix the problem by extending the affected weight register arrays with<br /> zeroed fields. The driver uses zeroed register addresses to determine<br /> if a register is supported or not, and skips accesses for unsupported<br /> registers.