CVE-2026-72397

A flaw was found in the Linux kernel's hwmon subsystem, specifically within the pmbus/core module. The pmbus_data2reg_vid() function incorrectly hardcoded the VR11 encoding, disregarding the vrm_version configured by the driver. This issue could lead to drivers sending dangerously wrong voltage codes to the Power Management Bus (PMBus) VOUT_COMMAND, potentially causing hardware instability or damage due to incorrect voltage regulation.

A moderate impact flaw was found in the Linux kernel PMBus hardware monitoring core (drivers/hwmon/pmbus/pmbus_core.c). The pmbus_data2reg_vid() function hardcoded the VR11 VID encoding when converting a requested voltage into a PMBUS_VOUT_COMMAND register value, ignoring the vrm_version configured by the driver, even though the corresponding read path pmbus_reg2data_vid() already honored it. On systems where a PMBus driver selects a non-VR11 VID mode (such as VR12, VR13, IMVP9, amd625mv, or nvidia195mv) and exposes a regulator or hwmon voltage setter, a local user with privileges to write to that interface could cause the kernel to send a dangerously wrong voltage code to the power-management chip; for example, a request for 200 mV could be encoded in a way the part interprets as 1080 mV. The consequence is incorrect voltage regulation that can lead to system instability, shutdown, or hardware damage. The flaw is not network-reachable and requires local privileged access to the exposed voltage-setting interface. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. The affected RHEL 8, RHEL 9, RHEL 10, and Red Hat In-Vehicle OS kernel streams currently carry a DEFER resolution, meaning the fix is deferred to a future planned update rather than an immediate update; until then, the residual risk is limited to local privileged users writing voltages on systems with affected PMBus hardware driven in a non-VR11 VID mode. Red Hat rates this flaw moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record rates it important (CVSS 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); the difference reflects Red Hat's assessment that the primary security impact is availability through hardware instability or damage rather than a confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.