CVE-2026-74711

A flaw was found in the Linux kernel's hardware monitoring (hwmon) subsystem, specifically within the Power Management Bus (pmbus) driver. This vulnerability arises from a type confusion issue where the system incorrectly interprets data types during notification processing. An attacker could exploit this by manipulating attribute structures, potentially leading to an out-of-bounds read. This could allow for information disclosure or system instability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and active Power Management Bus hardware, restricting the blast radius to a localized denial of service rather than system compromise. Enterprise Linux releases prior to version 10 are unaffected because the underlying attribute-handling logic was introduced in a newer upstream kernel. On supported systems running affected kernels, risk is confined to environments where alert notifications are processed by compatible power management devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.