CVE-2026-74685: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74685 Overview

CVE-2026-74685 is a Linux kernel vulnerability in the ltc4282 hardware monitoring (hwmon) driver. The flaw resides in ltc4282_write_curr() inside drivers/hwmon/ltc4282.c. A signed long value is cast directly to u64 without validation. Negative inputs become large positive values, and the subsequent division truncates into a pseudo-random positive result stored in a u32. The truncated value is then passed to ltc4282_write_voltage_byte(), where it is clamped to the maximum limit instead of zero. The upstream fix clamps val to 0 and to the maximum supported upper limit prior to the cast, and uses a 64-bit temporary for the division.

Critical Impact
A local user with permission to write current-limit sysfs attributes can silently set the ltc4282 controller to its maximum current limit, defeating overcurrent protection on affected hardware.

Affected Products

Linux kernel hwmon subsystem, ltc4282 driver (drivers/hwmon/ltc4282.c)
Stable kernel branches containing commits 046e56b5, 60e06c4d, de58b90a, and e253dd5f
Systems using the Analog Devices LTC4282 high-current hot-swap controller under Linux

Discovery Timeline

2026-08-22 - CVE-2026-74685 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74685

Vulnerability Analysis

The defect is a numeric truncation and sign-conversion issue in the ltc4282 hwmon driver. When user space writes to a current-limit attribute, the kernel routes the value through ltc4282_write_curr(). That function receives a signed long val and multiplies it by st->rsense after casting to u64. Because the cast happens before any range check, a negative val reinterprets as a very large unsigned quantity. The result of DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO) is then assigned into a u32 named in, which truncates the high-order bits. The remaining low-order bits form an unpredictable positive value that bypasses the intended "clamp to zero" semantics. Downstream, ltc4282_write_voltage_byte() treats this large residual as a valid target and clamps to the maximum permissible limit, effectively disabling the safety threshold the operator attempted to lower.

Root Cause

The root cause is improper input validation combined with a sign-conversion error [CWE-195, CWE-681]. The signed-to-unsigned cast precedes the bounds check, and an intermediate calculation is performed at a narrower width (u32) than required to hold the product. The patch addresses both issues by clamping val against 0 and the driver's maximum supported upper limit, then performing the arithmetic in a 64-bit temporary before the final narrowing.

Attack Vector

Exploitation requires local access with write permission to the driver's sysfs current-limit attributes, typically restricted to root or hwmon-privileged users. An attacker or a misbehaving management daemon writes a negative integer to a current-limit attribute exposed by the ltc4282 driver. The driver silently reinterprets the value, and the hardware controller is programmed with the maximum current limit rather than being clamped to zero. The result is loss of the configured overcurrent protection on power delivery paths managed by the LTC4282, with no error returned to the caller.

No synthetic exploit code is provided. See the upstream fix commits for the exact code paths and patched arithmetic: Kernel Git Commit 046e56b, Kernel Git Commit 60e06c4d, Kernel Git Commit de58b90a, and Kernel Git Commit e253dd5f.

Detection Methods for CVE-2026-74685

Indicators of Compromise

Unexpected writes of negative values to /sys/class/hwmon/hwmon*/curr*_max, curr*_crit, or related current-limit attributes on systems using the ltc4282 driver.
Hardware telemetry showing the LTC4282 current limit programmed at its maximum value despite a lower configuration policy.
Absence of overcurrent trip events on power rails that historically registered them under known-loaded conditions.

Detection Strategies

Audit userspace tooling and configuration management for callers that pass signed integers directly into hwmon current-limit sysfs nodes.
Compare the running kernel against the fix commits (046e56b5, 60e06c4d, de58b90a, e253dd5f) on stable branches to confirm whether the patch is present.
Correlate hwmon attribute writes with process ancestry to identify unauthorized modifications to power-management configuration.

Monitoring Recommendations

Enable auditd rules on /sys/class/hwmon/ write operations and forward events to a central log store for review.
Periodically read back current-limit attributes on LTC4282-controlled rails and alert when values match the driver's maximum instead of the configured baseline.
Track kernel version and module build IDs across the fleet to identify hosts still running vulnerable ltc4282 code.

How to Mitigate CVE-2026-74685

Immediate Actions Required

Apply a stable kernel update that includes the four upstream fix commits for drivers/hwmon/ltc4282.c.
Restrict write access to hwmon sysfs attributes to trusted administrative accounts and management daemons only.
Validate any userspace policy that programs LTC4282 current limits so that negative or out-of-range values are rejected before reaching the kernel.

Patch Information

The upstream Linux kernel fix clamps val to 0 and to the maximum supported upper limit prior to the u64 cast, and stores the multiplication in a 64-bit temporary to avoid the truncation into u32. Refer to Kernel Git Commit 046e56b, Kernel Git Commit 60e06c4d, Kernel Git Commit de58b90a, and Kernel Git Commit e253dd5f for the applicable stable branches.

Workarounds

Unbind or blacklist the ltc4282 module on systems that do not require it until a patched kernel is deployed.
Wrap current-limit writes with a userspace shim that rejects negative integers and values above the driver's documented maximum.
Enforce mandatory access control (SELinux, AppArmor) policies that limit which processes can write to hwmon current-limit attributes.

bash

# Configuration example: reject negative or out-of-range writes before they reach the driver
# Replace <hwmon_path> and <max_microamps> with values appropriate for your hardware.
set_curr_limit() {
    local path="$1"
    local value="$2"
    local max="$3"
    if [[ "$value" -lt 0 || "$value" -gt "$max" ]]; then
        echo "Refusing out-of-range current limit: $value" >&2
        return 1
    fi
    echo "$value" > "$path"
}