CVE-2026-46073: Linux Kernel hwmon URB Handling Flaw

CVE-2026-46073 Overview

CVE-2026-46073 is a Linux kernel vulnerability in the hwmonpowerz driver. The flaw stems from improper handling of the return value from wait_for_completion_interruptible_timeout(). When a signal interrupts the wait, the function returns -ERESTARTSYS, but the original code only checks for the timeout case (!ret). As a result, the driver skips the required usb_kill_urb() call and reads from an unfilled transfer buffer. This leads to use of uninitialized memory from the USB transfer buffer when a signal arrives during a sensor read operation.

Critical Impact
Local processes reading from the powerz hardware monitoring driver can trigger reads of uninitialized kernel transfer buffer memory when a signal interrupts the USB completion wait.

Affected Products

Linux kernel containing the hwmonpowerz driver
Stable kernel branches receiving the backported fix referenced in the upstream commits
Distributions shipping the affected powerz hwmon driver prior to the patch

Discovery Timeline

2026-05-27 - CVE-2026-46073 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46073

Vulnerability Analysis

The powerz hwmon driver communicates with a USB device to retrieve power telemetry. It submits a URB (USB Request Block) and waits for completion using wait_for_completion_interruptible_timeout(). This kernel function returns three distinct values: a positive number on completion, 0 on timeout, and -ERESTARTSYS when a signal interrupts the wait.

The original code stored the return value in a variable and tested only !ret. That condition is true only when the return is 0 (timeout). When a signal arrives, the return is negative, the !ret branch is skipped, and execution falls through to code that reads from the transfer buffer. Because the URB was never killed and no data was received, the buffer contains stale or uninitialized contents. This is classified as uninitialized memory use [CWE-908] in a kernel driver path reachable by unprivileged readers of the hwmon interface.

Root Cause

The root cause is an incomplete return-value check against a tri-state function result. The code conflated "not timed out" with "completed successfully," ignoring the signal-interrupt path. The fix captures the return value into a long matching the function's declared return type and adds separate checks for negative (signal) and zero (timeout) cases. Both paths now call usb_kill_urb() to abort the outstanding transfer before returning an error to the caller.

Attack Vector

A local user with access to the hwmon sysfs interface for the powerz device can read sensor attributes while a signal is delivered to the reading process. If timing aligns with the interruptible wait, the driver returns sensor values derived from uninitialized buffer contents. This produces incorrect readings and may leak residual kernel memory contents through the hwmon attribute values exposed to user space. Remote exploitation is not applicable, since physical USB device presence and local access are required.

The vulnerability mechanism is described in the upstream commits. See the Kernel Git Commit 8b51277 and Kernel Git Commit d644587 for the corrected return-value handling and the added usb_kill_urb() calls.

Detection Methods for CVE-2026-46073

Indicators of Compromise

Inconsistent or implausible power telemetry values returned from powerz hwmon sysfs attributes
User-space processes reading hwmon attributes that receive frequent signal delivery during the read syscall
Kernel log entries showing USB transfer errors or -ERESTARTSYS returns from the powerz driver path

Detection Strategies

Audit kernel package versions against the patched commits referenced in the NVD entry to identify unpatched systems
Inspect user-space callers of /sys/class/hwmon/*/ paths backed by the powerz driver for unusual signal-driven read patterns
Correlate hwmon sensor anomalies with process signal activity using kernel tracing facilities such as ftrace or bpftrace

Monitoring Recommendations

Track kernel version inventory across Linux endpoints and flag hosts running unpatched powerz driver builds
Monitor dmesg and the journal for USB and hwmon subsystem errors associated with powerz
Restrict and log access to hwmon interfaces on systems where the ChargerLAB POWER-Z device is connected

How to Mitigate CVE-2026-46073

Immediate Actions Required

Apply the upstream kernel patches that introduce correct handling of -ERESTARTSYS and add usb_kill_urb() calls before returning
Update to a distribution kernel package that includes the four referenced stable backports
Where patching is delayed, unload the powerz module on systems that do not require ChargerLAB POWER-Z telemetry

Patch Information

The fix is available in the following upstream commits: Kernel Git Commit 8b51277, Kernel Git Commit b66437c, Kernel Git Commit b6cb07f, and Kernel Git Commit d644587. The patch changes the return-value variable to long, adds a negative-value branch for signal interruption, and ensures usb_kill_urb() is invoked on both signal and timeout paths.

Workarounds

Blacklist the powerz kernel module on systems where the ChargerLAB POWER-Z USB device is not in use
Restrict access to hwmon sysfs attributes for the powerz device through file permissions or udev rules
Avoid sending signals to processes actively reading powerz hwmon attributes until the patch is applied

bash

# Blacklist the powerz module until the kernel is patched
echo "blacklist powerz" | sudo tee /etc/modprobe.d/blacklist-powerz.conf
sudo rmmod powerz 2>/dev/null || true
sudo update-initramfs -u