CVE-2026-72397

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72397
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72397.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72397
Downstream
Published
2026-08-15T05:56:23Z
Modified
2026-10-24T02:30:16Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
Details

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()

pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the vrm_version configured by the driver, while pmbus_reg2data_vid() already switched on it. Any driver that selects a non-VR11 VID mode and exposes a regulator (or hwmon vout setter) sent dangerously wrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the chip interprets as 1080 mV.

Mirror pmbus_reg2data_vid() so writes round-trip with reads.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72397.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
068c227056b9223fea1a759e08db2558d5cbb5ad
Fixed
cd0e037130806d7714c356eccefac6e1b92dbc34
Fixed
125a5a4ad03c74ced4c2a55db45ef03505362ff9
Fixed
5bd0d47640395f8a8c34446b62d1781b88869dfa
Fixed
828cd614e2af053ca5e1d6da767bbd8a1b5cabfb

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72397.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72397.json"