CVE-2026-74553

A flaw was found in the Linux kernel's hwmon (hardware monitoring) subsystem, specifically within the nct6775-core driver. This vulnerability arises from incorrect handling of temperature registers for the NCT6116 chip, where the driver attempts to access more registers than are available. This out-of-bounds read can lead to a Kernel Address Sanitizer (KASAN) report, potentially causing a system crash and resulting in a denial of service.

A low impact out-of-bounds read flaw was found in the Linux kernel's nct6775-core hardware monitoring driver. When probing a Nuvoton NCT6116 chip, the driver used the size of the NCT6106 temperature source register array (six entries) to determine the number of registers, while the NCT6116 array provides only three addresses. This causes nct6775_probe to read past the end of a global static register array, producing a KASAN global-out-of-bounds report and potentially a kernel panic, resulting in a denial of service. No confidentiality or integrity impact is expected. Reliable triggering requires local privileged access (for example, to load or probe the driver) on systems equipped with the affected NCT6116 hardware, and the issue is not network reachable. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in their kernel and kernel-rt packages. The kernel packages in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix for these streams is currently deferred given the low impact and limited practical exploitability, and the residual risk is a potential system crash (denial of service) during driver probing on systems with NCT6116 hardware. Although the CVSS:3.1 base score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5, moderate) is higher, Red Hat rates the overall impact of this flaw as low because the out-of-bounds read is confined to adjacent static kernel data during hardware-specific initialization and reliable exploitation requires privileged local access to systems with the affected hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.