{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "f469bde9afd136598a0c4edc054296e6046f90ee"
            },
            {
              "fixed": "821f6416e69782fa662aff94b5ea52c943042790"
            },
            {
              "fixed": "0b121de89a99c54bcf516999b04e8531c84f08d5"
            },
            {
              "fixed": "59bd68ab05a8f9c9a60b6ec44682084184803ff4"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.4.0"
            },
            {
              "fixed": "6.18.45"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74711.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n    for (i = 0; i \u003c data-\u003enum_attributes; i++) {\n        struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\n        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n        int index = attr-\u003eindex;\n...\n}\n\nHowever, data-\u003egroup.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values.",
  "id": "CVE-2026-74711",
  "modified": "2026-08-27T11:30:40.960140021Z",
  "published": "2026-08-22T15:33:07.779Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74711.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74711"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "hwmon: (pmbus) Fix type confusion in notification logic"
}