CVE-2026-43380: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43380 Overview

CVE-2026-43380 is a stack buffer overflow vulnerability in the Linux kernel's hardware monitoring (hwmon) subsystem, specifically in the pmbus/q54sj108a2 driver. The flaw resides in the q54sj108a2_debugfs_read function, which incorrectly invokes bin2hex() with swapped arguments and an undersized destination buffer. A 32-byte block read produces 64 bytes of hex output, but the destination buffer holds only 34 bytes (I2C_SMBUS_BLOCK_MAX + 2). This causes 30 bytes to be written past the end of a stack buffer. The issue also resulted in all-zero output because the function read from a zero-initialized buffer instead of the actual I2C data.

Critical Impact
Local kernel stack corruption triggered through debugfs reads on systems using the q54sj108a2 PMBus driver, potentially leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel versions containing the pmbus/q54sj108a2 hwmon driver prior to the fix
Systems with the Delta Q54SJ108A2 power module driver enabled
Kernel stable branches referenced in the patch commits

Discovery Timeline

2026-05-08 - CVE-2026-43380 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43380

Vulnerability Analysis

The vulnerability exists in the q54sj108a2_debugfs_read function within the Linux kernel hwmon PMBus driver for the Delta Q54SJ108A2 power module. The function reads a block of data from the device over I2C and converts the binary content to a human-readable hexadecimal string using bin2hex(). The conversion expands each input byte into two output characters, so a maximum 32-byte I2C block read produces 64 hex characters plus a null terminator.

The original code allocated only I2C_SMBUS_BLOCK_MAX + 2 (34 bytes) for the output buffer while passing the larger conversion result into it. This caused a stack overflow of up to 30 bytes. Additionally, the arguments to bin2hex() were swapped, causing the function to read from a zero-initialized buffer and write into the originally intended source buffer. The result was both an out-of-bounds write [CWE-121] and an information correctness issue where userspace always observed zeros.

Root Cause

The root cause is a developer error in argument ordering and buffer sizing in the bin2hex() call inside q54sj108a2_debugfs_read. The destination buffer data was too small to hold the doubled output, and the source and destination pointers were transposed. The fix expands data_char to 66 bytes, corrects the bin2hex() argument order, uses the actual read count, and selects the correct output buffer for the final simple_read_from_buffer call.

Attack Vector

An attacker requires local access with permission to read the relevant debugfs entries exposed by the q54sj108a2 driver. Reading the affected debugfs node triggers the overflow on the kernel stack. Because debugfs is typically restricted to root, exploitation requires elevated local privileges or a misconfiguration that exposes debugfs to lower-privileged users. Successful exploitation can corrupt kernel stack memory and may lead to kernel panic or memory disclosure depending on stack layout and protections such as stack canaries.

No verified proof-of-concept code is available. Refer to the upstream patch commits for the exact code-level changes.

Detection Methods for CVE-2026-43380

Indicators of Compromise

Kernel oops or panic messages referencing q54sj108a2_debugfs_read or stack corruption in the hwmon subsystem
Stack protector failure messages (Kernel stack is corrupted in: q54sj108a2_debugfs_read) in dmesg or /var/log/kern.log
Unexpected reads of debugfs entries under /sys/kernel/debug/ related to the q54sj108a2 driver from non-administrative contexts

Detection Strategies

Audit kernel build configuration to identify hosts that compile or load the pmbus_q54sj108a2 module
Monitor kernel logs for stack canary violations and oops traces involving hwmon PMBus code paths
Track access to /sys/kernel/debug/ paths owned by the q54sj108a2 driver using Linux audit subsystem rules

Monitoring Recommendations

Enable CONFIG_STACKPROTECTOR_STRONG and forward kernel ring buffer messages to a central log aggregator
Alert on any non-root process attempting to read debugfs entries exposed by hwmon drivers
Inventory kernel versions across the fleet and flag hosts running unpatched stable branches listed in the upstream commits

How to Mitigate CVE-2026-43380

Immediate Actions Required

Apply the upstream stable kernel patches that correct the bin2hex() usage in q54sj108a2_debugfs_read
Restrict access to /sys/kernel/debug/ to root only by ensuring debugfs is mounted with mode=0700 or unmounted on production systems
Unload the pmbus_q54sj108a2 module on hosts that do not require monitoring of the Delta Q54SJ108A2 power module

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Refer to the upstream commits: Kernel Patch Commit 24a7b9d, Kernel Patch Commit 25dd70a0, Kernel Patch Commit 52db5ef1, Kernel Patch Commit 73a7a345, Kernel Patch Commit a0fc1b9c, Kernel Patch Commit b48a0f8d, and Kernel Patch Commit c59090c5. Rebuild and reboot affected systems after applying the patch.

Workarounds

Disable debugfs at boot by removing the debugfs mount entry from /etc/fstab or adding debugfs=off to the kernel command line where supported
Blacklist the pmbus_q54sj108a2 module on systems that do not need it by adding blacklist pmbus_q54sj108a2 to /etc/modprobe.d/
Tighten permissions on /sys/kernel/debug/ to restrict reads to privileged users only

bash

# Configuration example
# Restrict debugfs access to root only
mount -o remount,mode=700 /sys/kernel/debug

# Blacklist the vulnerable module until patched
echo 'blacklist pmbus_q54sj108a2' | sudo tee /etc/modprobe.d/cve-2026-43380.conf
sudo rmmod pmbus_q54sj108a2 2>/dev/null || true