CVE-2026-74711: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74711 Overview

CVE-2026-74711 is a type confusion vulnerability in the Linux kernel's hwmon PMBus driver. The flaw resides in the pmbus_notify() function within drivers/hwmon/pmbus/pmbus_core.c. The code unconditionally casts every attribute in data->group.attrs to struct sensor_device_attribute, even though the array can contain other types such as struct pmbus_samples_reg and struct pmbus_sensor. This mismatched cast leads to reads past the end of the allocation and produces incorrect index values used in alert dispatching.

Critical Impact
A local attacker with the ability to trigger PMBus notifications can cause a slab-out-of-bounds read and misinterpret memory as page, phase, and register fields, potentially affecting kernel integrity and availability.

Affected Products

Linux kernel hwmon subsystem
PMBus driver (drivers/hwmon/pmbus/pmbus_core.c)
Systems using PMBus-connected power management devices

Discovery Timeline

2026-08-22 - CVE-2026-74711 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74711

Vulnerability Analysis

The defect is a [Type Confusion] flaw in the PMBus notification path. At the start of the loop in pmbus_notify(), the code casts each entry in data->group.attrs to struct sensor_device_attribute and reads the attr->index field. This cast is unsafe because the attribute array holds heterogeneous structures. Only the base struct device_attribute is common across them.

When the attribute is actually a struct pmbus_samples_reg, the base dev_attr sits at the end of the structure. Casting it to struct sensor_device_attribute and dereferencing index reads memory beyond the allocation, producing a slab-out-of-bounds read. When the attribute is a struct pmbus_sensor, the index field overlaps with the page, phase, and reg members, yielding a garbage mask on little-endian systems that can spuriously match target register, page, and flag values during an alert.

Root Cause

The root cause is the unconditional cast of a base struct device_attribute pointer to struct sensor_device_attribute without verifying the underlying object type. The heterogeneous attribute list violates the assumption baked into the notification loop.

Attack Vector

Exploitation requires local access on a system exposing PMBus hardware. Triggering PMBus alerts or status changes drives pmbus_notify() across the mistyped attributes, exposing out-of-bounds memory reads and spurious notification dispatches. See the upstream fix commit for the sanitized correction.

// Vulnerable pattern (paraphrased from the advisory)
// for (i = 0; i < data->num_attributes; i++) {
//     struct device_attribute *da = to_dev_attr(data->group.attrs[i]);
//     struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
//     int index = attr->index; // unsafe when da is not a sensor_device_attribute
// }

Detection Methods for CVE-2026-74711

Indicators of Compromise

Kernel logs reporting KASAN slab-out-of-bounds reads originating in pmbus_notify() or drivers/hwmon/pmbus/pmbus_core.c.
Unexpected PMBus alert handling on registers, pages, or phases that do not correspond to installed hardware.
Kernel oops or warnings tied to hwmon PMBus attribute iteration under load.

Detection Strategies

Enable KASAN on test kernels to surface the out-of-bounds read on affected builds.
Audit running kernel versions against the fixed commits 0b121de89a99, 59bd68ab05a8, and 821f6416e697 referenced by the kernel.org stable tree.
Correlate hwmon and PMBus subsystem messages in centralized logging to identify anomalous alert bursts.

Monitoring Recommendations

Ship dmesg and /var/log/kern.log output to a SIEM and alert on pmbus_notify or KASAN entries.
Track kernel package versions across the fleet to confirm patched builds are deployed on hosts with PMBus hardware.
Baseline PMBus alert frequency per host so deviations that could indicate spurious matches are visible.

How to Mitigate CVE-2026-74711

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commit set as soon as vendor rebuilds are available.
Restrict local access on systems exposing PMBus-controlled power devices to trusted administrators.
Prioritize patching on servers, storage appliances, and hardware management controllers that expose PMBus through hwmon.

Patch Information

The fix replaces the base struct device_attribute in struct pmbus_sensor and struct pmbus_label with struct sensor_device_attribute, and sets attr->index to -1 for attributes that never trigger notifications. The notification loop uses this sentinel to distinguish boolean attributes that legitimately encode mask, page, and register values in index. Fixed commits are available at 0b121de89a99, 59bd68ab05a8, and 821f6416e697.

Workarounds

Unload the pmbus and dependent hwmon modules on systems where PMBus telemetry is not required.
Constrain access to hwmon sysfs paths so only privileged monitoring agents can interact with PMBus attributes.
Where feasible, disable PMBus alert generation in firmware until a patched kernel is deployed.

bash

# Verify kernel version and confirm the PMBus module state
uname -r
lsmod | grep pmbus
# Optionally unload if PMBus telemetry is not needed
sudo modprobe -r pmbus