{"id":"CVE-2026-80696","state":"PUBLISHED","title":"hwmon: (ltc4282) Fix reading the minimum alarm voltage","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Fix reading the minimum alarm voltage\n\nCoverity reports an out-of-bounds access when reading the minimum alarm\nvoltage for the VGPIO channel. Add the missing return statement to fix\nthe problem.","publishedAt":"2026-08-28T06:53:01.632Z","updatedAt":"2026-08-29T06:22:19.564Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"338d655fe09b95a88788c6ac8b1651ca8db9ae51","versionType":"git"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"08aee6d45eefc9e0b94c21bd442f47b21d64fa2c","versionType":"git"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"a0668ac20feaa3fff9e0c0548556368dbbd2d439","versionType":"git"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"00feb1cce93dab948a299b69753d99c681d45a0b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwmon/ltc4282.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.9","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwmon/ltc4282.c"]}],"references":["https://git.kernel.org/stable/c/338d655fe09b95a88788c6ac8b1651ca8db9ae51","https://git.kernel.org/stable/c/08aee6d45eefc9e0b94c21bd442f47b21d64fa2c","https://git.kernel.org/stable/c/a0668ac20feaa3fff9e0c0548556368dbbd2d439","https://git.kernel.org/stable/c/00feb1cce93dab948a299b69753d99c681d45a0b"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80696.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80696","state":"PUBLISHED","datePublished":"2026-08-28T06:53:01.632Z","dateUpdated":"2026-08-29T06:22:19.564Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.785Z"},"containers":{"cna":{"title":"hwmon: (ltc4282) Fix reading the minimum alarm voltage","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Fix reading the minimum alarm voltage\n\nCoverity reports an out-of-bounds access when reading the minimum alarm\nvoltage for the VGPIO channel. Add the missing return statement to fix\nthe problem."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"338d655fe09b95a88788c6ac8b1651ca8db9ae51","versionType":"git"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"08aee6d45eefc9e0b94c21bd442f47b21d64fa2c","versionType":"git"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"a0668ac20feaa3fff9e0c0548556368dbbd2d439","versionType":"git"},{"version":"cbc29538dbf7d7400f1ffc5dd5713e6a551463a0","status":"affected","lessThan":"00feb1cce93dab948a299b69753d99c681d45a0b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwmon/ltc4282.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.9","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hwmon/ltc4282.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/338d655fe09b95a88788c6ac8b1651ca8db9ae51"},{"url":"https://git.kernel.org/stable/c/08aee6d45eefc9e0b94c21bd442f47b21d64fa2c"},{"url":"https://git.kernel.org/stable/c/a0668ac20feaa3fff9e0c0548556368dbbd2d439"},{"url":"https://git.kernel.org/stable/c/00feb1cce93dab948a299b69753d99c681d45a0b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only by a local read(2) on /sys/class/hwmon/hwmonN/in2_min_alarm (sysfs -> hwmon_attr_show -> ltc4282_read -> ltc4282_read_in); the LTC4282 I2C hwmon driver has no network, wireless, or direct physical-bus attack surface.\nAC:L - On systems with an LTC4282 bound, any read of in2_min_alarm deterministically executes the missing-return fallthrough and out-of-bounds in0_1_cache[2].en access; the attacker fully controls triggering with no race or conditions outside their control.\nPR:L - in2_min_alarm is exposed as mode 0444 with no capability checks beyond standard sysfs permissions, so any unprivileged local user on a host with LTC4282 hardware can invoke the vulnerable read path without init-namespace root or user-namespace privileges.\nUI:N - Exploitation requires only the attacker (or attacker-controlled monitoring software) to read the hwmon sysfs attribute; no separate victim action such as plugging hardware, mounting filesystems, or approving prompts is needed.\nS:U - The out-of-bounds read and conditional hardware alarm-bit clearing remain within the host kernel/driver context managing the local LTC4282; they do not cross VM, container, IOMMU, or other changed security-authority boundaries.\nC:H - The fallthrough indexes in0_1_cache[2] past the two-element array, performing an out-of-bounds read of adjacent ltc4282_state memory (energy_en/padding) that steers control flow and can return incorrect in2_min_alarm data to userspace.\nI:H - When the out-of-bounds .en byte is non-zero, the fallthrough calls __ltc4282_read_alarm() with VSOURCE_ALARM_L_MASK, clearing the VSOURCE undervoltage alarm bit on the live LTC4282 hot-swap controller and corrupting safety-critical power-rail monitoring on datacenter/telecom racks.\nA:H - Clearing VSOURCE undervoltage alarms on an LTC4282 controlling live backplane/linecard hot-swap power can mask critical rail faults, enabling undetected power events and sustained rack or linecard outages on affected server and industrial deployments."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-29T06:22:19.564Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}