CVE-2026-74549

A flaw was found in the hwmon (hardware monitoring) driver for the nct6775-core in the Linux kernel. During initialization, the driver incorrectly accesses memory beyond the allocated buffer when handling certain register arrays. This out-of-bounds read can lead to the use of invalid hardware register addresses, potentially causing hardware misconfiguration or a system crash. A local attacker with access to the hardware monitoring functionality could exploit this vulnerability.

The nct6775 hwmon driver can read past the end of several nct6116 weight control register arrays because the chip exposes up to five PWM channels while these arrays originally contained only three entries. The out of bounds values can then be used as hardware register addresses for later read or write operations, which may cause invalid hardware access, fan control misconfiguration, or a system crash. For the CVSS the PR:L value is used because a local user or local monitoring process may be able to trigger hwmon update paths, while reliable triggering still depends on the affected nct6116 hardware and driver state. The issue is not network reachable. Impact is at least local denial of service or hardware misconfiguration, and in the paranoid interpretation it may allow limited confidentiality or integrity impact due to a kernel global out of bounds read and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.