hwmon: (pmbus) Fix passing events to regulator core
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator events over time using atomic_or(). The delayed worker then passes the combined bitmask unmodified to regulator_notifier_call_chain(). The core regulator subsystem's regulator_handle_critical() function evaluates the event parameter using a strict switch statement. If multiple distinct faults occur before the worker runs (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined bitmask fails to match any case. This leaves the reason as NULL and completely bypasses the critical hw_protection_trigger(). Fix the problem by passing events bit by bit to the regulator event handler.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 6.6.143 to before 6.6.145; 6.12.92 to before 6.12.97; 6.18.21 to before 6.18.40; 6.1.191 to before 6.2; 6.19.11 to before 6.20 | 6.6.145, 6.12.97, 6.18.40, 6.2, 6.20 | Patch available | CNA |
| Linux | Linux | 7.0 and later | 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2 | Patch available | CNA |
- Linux VendorLinux Affected 6.6.143 to before 6.6.145; 6.12.92 to before 6.12.97; 6.18.21 to before 6.18.40; 6.1.191 to before 6.2; 6.19.11 to before 6.20 Fixed in 6.6.145, 6.12.97, 6.18.40, 6.2, 6.20 Patch available CNA
- Linux VendorLinux Affected 7.0 and later Fixed in 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2 Patch available CNA
Remediation
- Fix · CNA Linux (Linux) Fixed in 6.6.145, 6.12.97, 6.18.40, 6.2, 6.20
- Fix · CNA Linux (Linux) Fixed in 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-72395
- 2026-10-03 Alias added: GHSA-w4gm-vhrh-5h95
- 2026-10-30 Fix available: Linux/[email protected] · CNA
References
Other 5
- https://git.kernel.org/stable/c/2106bf4056858fcce3624e0c51f6fee4d41d3f2f
- https://git.kernel.org/stable/c/48fe43666950efefb7ac5fbdc012c1b3604096bf
- https://git.kernel.org/stable/c/489291b6b56978cc50d34e8e13f9636ea296ba8a
- https://git.kernel.org/stable/c/b0ff6b6ae9c5183ef701ece7016698bde5a5bfba
- https://git.kernel.org/stable/c/9ef7dacd44216bf5ea05c8aef49eba4d145f4047
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-72395 · CVE Program
- CVE-2026-72395 · NVD
- FIRST EPSS
- GHSA-w4gm-vhrh-5h95 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-72395 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences