CVE-2026-72395

A flaw was found in the Linux kernel's hwmon (pmbus) subsystem. A worker designed to batch regulator events can combine multiple distinct hardware fault events into a single bitmask. This combined bitmask is then incorrectly processed by the critical hardware protection function, regulator_handle_critical(), causing it to bypass essential safety mechanisms. This could prevent the system from properly responding to critical hardware faults, potentially leading to system instability or damage.

A moderate-impact flaw was found in the Linux kernel hwmon (pmbus) subsystem. A delayed worker introduced by a recent upstream commit batches regulator events by combining them into a single bitmask with atomic_or() and passes that bitmask unmodified to regulator_notifier_call_chain(). Because the regulator core's regulator_handle_critical() function evaluates events with a strict switch statement, a combined bitmask of multiple distinct faults (for example REGULATOR_EVENT_UNDER_VOLTAGE together with REGULATOR_EVENT_OVER_CURRENT) matches no case, leaves the reason as NULL, and completely bypasses the critical hw_protection_trigger() action. As a consequence, when multiple distinct pmbus regulator faults occur before the worker runs, the kernel may fail to carry out its critical hardware-protection response, which can lead to system instability or hardware damage. This is a local robustness defect in event handling triggered by coincident hardware fault conditions, with no confidentiality impact; it is not a remotely exploitable vulnerability. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt components are not affected because the vulnerable code, introduced upstream in recent mainline and stable kernel releases, is not present in the Red Hat shipped kernels. Red Hat's severity of Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the CVE.org score of 7.1 (Important), which additionally counts a high integrity impact; Red Hat assesses the issue as a failure to trigger a protective response affecting availability rather than a direct compromise of data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.