GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72395 (GCVE-0-2026-72395)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:43
VLAI
Title
hwmon: (pmbus) Fix passing events to regulator core
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator events over time using atomic_or(). The delayed worker then passes the combined bitmask unmodified to regulator_notifier_call_chain(). The core regulator subsystem's regulator_handle_critical() function evaluates the event parameter using a strict switch statement. If multiple distinct faults occur before the worker runs (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined bitmask fails to match any case. This leaves the reason as NULL and completely bypasses the critical hw_protection_trigger(). Fix the problem by passing events bit by bit to the regulator event handler.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b26849cffaa7c43355b82e9bef3725e786973a1a , < 2106bf4056858fcce3624e0c51f6fee4d41d3f2f (git)
Affected: acf04e2863132f6d9222f71f3a76fb9782cbe061 , < 48fe43666950efefb7ac5fbdc012c1b3604096bf (git)
Affected: 4e9d723d9f198b86f6882a84c501ba1f39e8d055 , < 489291b6b56978cc50d34e8e13f9636ea296ba8a (git)
Affected: 754bd2b4a084b90b5e7b630e1f423061a9b9b761 , < b0ff6b6ae9c5183ef701ece7016698bde5a5bfba (git)
Affected: 754bd2b4a084b90b5e7b630e1f423061a9b9b761 , < 9ef7dacd44216bf5ea05c8aef49eba4d145f4047 (git)
Affected: 2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07 (git)
Affected: 6.6.143 , < 6.6.145 (semver)
Affected: 6.12.92 , < 6.12.97 (semver)
Affected: 6.18.21 , < 6.18.40 (semver)
Affected: 6.19.11 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/pmbus_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2106bf4056858fcce3624e0c51f6fee4d41d3f2f",
              "status": "affected",
              "version": "b26849cffaa7c43355b82e9bef3725e786973a1a",
              "versionType": "git"
            },
            {
              "lessThan": "48fe43666950efefb7ac5fbdc012c1b3604096bf",
              "status": "affected",
              "version": "acf04e2863132f6d9222f71f3a76fb9782cbe061",
              "versionType": "git"
            },
            {
              "lessThan": "489291b6b56978cc50d34e8e13f9636ea296ba8a",
              "status": "affected",
              "version": "4e9d723d9f198b86f6882a84c501ba1f39e8d055",
              "versionType": "git"
            },
            {
              "lessThan": "b0ff6b6ae9c5183ef701ece7016698bde5a5bfba",
              "status": "affected",
              "version": "754bd2b4a084b90b5e7b630e1f423061a9b9b761",
              "versionType": "git"
            },
            {
              "lessThan": "9ef7dacd44216bf5ea05c8aef49eba4d145f4047",
              "status": "affected",
              "version": "754bd2b4a084b90b5e7b630e1f423061a9b9b761",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.40",
              "status": "affected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/pmbus_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.143",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix passing events to regulator core\n\nSashiko reports:\n\nCommit 754bd2b4a084 (\"hwmon: (pmbus/core) Protect regulator operations with\nmutex\") introduced a worker to batch regulator events over time using\natomic_or(). The delayed worker then passes the combined bitmask unmodified\nto regulator_notifier_call_chain().\n\nThe core regulator subsystem\u0027s regulator_handle_critical() function\nevaluates the event parameter using a strict switch statement. If\nmultiple distinct faults occur before the worker runs (e.g.,\nREGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined\nbitmask fails to match any case. This leaves the reason as NULL and\ncompletely bypasses the critical hw_protection_trigger().\n\nFix the problem by passing events bit by bit to the regulator event\nhandler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable through the PMBus SMBALERT threaded IRQ handler (pmbus_fault_handler) that reads hardware fault status over I2C; there is no network, adjacent-radio, or direct physical-device API path, but local actors on PMBus-equipped servers, routers, and embedded boards can induce multi-fault conditions.\nAC:L - _pmbus_get_flags() ORs multiple REGULATOR_EVENT_* bits from a single STATUS read, and pmbus_regulator_notify() further batches concurrent IRQs via atomic_or() before the worker runs, so combined masks like UNDER_VOLTAGE|OVER_CURRENT are produced deterministically without races or layout dependencies the attacker cannot influence.\nPR:L - Triggering the IRQ requires causing real PMBus regulator fault bits (e.g., over-current plus under-voltage during supply stress), which an unprivileged local user can induce through heavy workload and power instability on affected platforms; CAP_NET_ADMIN/user-namespace tricks are not needed and no init-namespace root capability is required.\nUI:N - Once fault conditions are present the SMBALERT IRQ and workqueue fire automatically through pmbus_fault_handler and pmbus_regulator_notify_worker; no separate victim action such as mounting media, plugging hardware, or approving a prompt is required.\nS:U - The impact is bypassing kernel hw_protection_trigger() orderly shutdown/reboot for system-critical PMBus regulators on the same host; it does not cross VM, IOMMU, or sandbox security boundaries and is not a guest-to-host escape.\nC:N - This is a notifier bit-mask logic error that leaves regulator_handle_critical() with a NULL reason; there is no kernel memory corruption, use-after-free, or out-of-bounds access that could disclose pointers or arbitrary memory.\nI:H - When multiple distinct fault events are combined, hw_protection_trigger() is completely skipped for system-critical regulators, defeating the kernel\u0027s mandatory emergency shutdown policy and allowing continued operation under simultaneous critical under-voltage/over-current/fail conditions that can corrupt power hardware.\nA:H - Bypassing hw_protection_trigger() during simultaneous critical PMBus regulator faults prevents the intended emergency orderly_poweroff/reboot, leaving telecom, data-center, and embedded systems running under dangerous rail conditions that can cause hardware failure, forced resets, and sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:38.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047"
        }
      ],
      "title": "hwmon: (pmbus) Fix passing events to regulator core",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72395",
    "datePublished": "2026-08-15T05:56:22.400Z",
    "dateReserved": "2026-08-09T03:40:39.924Z",
    "dateUpdated": "2026-08-17T05:43:38.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72395",
      "date": "2026-09-15",
      "epss": "0.00169",
      "percentile": "0.06598"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72395\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:13.043\",\"lastModified\":\"2026-08-17T06:19:05.997\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (pmbus) Fix passing events to regulator core\\n\\nSashiko reports:\\n\\nCommit 754bd2b4a084 (\\\"hwmon: (pmbus/core) Protect regulator operations with\\nmutex\\\") introduced a worker to batch regulator events over time using\\natomic_or(). The delayed worker then passes the combined bitmask unmodified\\nto regulator_notifier_call_chain().\\n\\nThe core regulator subsystem\u0027s regulator_handle_critical() function\\nevaluates the event parameter using a strict switch statement. If\\nmultiple distinct faults occur before the worker runs (e.g.,\\nREGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined\\nbitmask fails to match any case. This leaves the reason as NULL and\\ncompletely bypasses the critical hw_protection_trigger().\\n\\nFix the problem by passing events bit by bit to the regulator event\\nhandler.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/pmbus/pmbus_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b26849cffaa7c43355b82e9bef3725e786973a1a\",\"lessThan\":\"2106bf4056858fcce3624e0c51f6fee4d41d3f2f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"acf04e2863132f6d9222f71f3a76fb9782cbe061\",\"lessThan\":\"48fe43666950efefb7ac5fbdc012c1b3604096bf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e9d723d9f198b86f6882a84c501ba1f39e8d055\",\"lessThan\":\"489291b6b56978cc50d34e8e13f9636ea296ba8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"754bd2b4a084b90b5e7b630e1f423061a9b9b761\",\"lessThan\":\"b0ff6b6ae9c5183ef701ece7016698bde5a5bfba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"754bd2b4a084b90b5e7b630e1f423061a9b9b761\",\"lessThan\":\"9ef7dacd44216bf5ea05c8aef49eba4d145f4047\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.143\",\"lessThan\":\"6.6.145\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.92\",\"lessThan\":\"6.12.97\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.18.21\",\"lessThan\":\"6.18.40\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.19.11\",\"lessThan\":\"6.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/pmbus/pmbus_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T15:16:37+00:00",
      "cve": "CVE-2026-72395",
      "id": "CVE-2026-72395",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hwmon: (pmbus) Fix passing events to regulator core",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72395.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:04:42Z",
      "cve": "CVE-2026-72395",
      "id": "CVE-2026-72395",
      "initial_release_date": "2026-09-02T01:04:42Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72395",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72395.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.