Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data->pwm_num to 5. However, it assigns several NCT6106 register arrays (such as NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP. These arrays only contain 3 elements. In nct6775_update_pwm(), the driver iterates up to data->pwm_num. If data->has_pwm has bits 3 or 4 set (which is structurally possible for nct6116), the loop attempts to read elements at index 3 and 4 from these 3-element arrays. This results in a global out-of-bounds read, which can be caught by KASAN. Furthermore, the driver uses these garbage out-of-bounds values as hardware register addresses for subsequent read and write operations. This leads to invalid hardware register access, potentially causing hardware misconfiguration or system crashes. The underlying problem is that the chip does support up to five fan control channels, but only the first three support weight control. Fix the problem by extending the affected weight register arrays with zeroed fields. The driver uses zeroed register addresses to determine if a register is supported or not, and skips accesses for unsupported registers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:18:00.270Z",
  "pubdate": "2026-08-15T13:18:00.270Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel hwmon subsystem, specifically within the nct6775-core driver, involving improper handling of hardware weight register arrays for specific chip models like the nct6116.\nThe vulnerability type is an out-of-bounds read leading to invalid hardware register access, which can be triggered locally by a privileged user or process capable of interacting with hardware monitoring interfaces.\nThe impact includes kernel memory exposure via out-of-bounds reads detectable by KASAN, invalid hardware register read and write operations, potential hardware misconfiguration, and system instability or crashes.\nAffected systems include Linux kernel environments utilizing the nct6775-core driver with hardware chips that support more PWM channels than weight control channels, such as the nct6116 utilizing NCT6106 register arrays.\nExploitation requirements include local execution capability and kernel-level interaction or root privileges to load or interact with the affected hardware monitoring driver, though trigger conditions depend on specific hardware configurations where data->pwm_num exceeds the size of weight register arrays.",
  "technicalDetails": "The vulnerability resides in the nct6775-core driver of the Linux kernel hardware monitoring subsystem. The root cause is a mismatch between the configured number of PWM channels and the physical capabilities regarding weight control for specific hardware variants.\nDuring the initialization phase of the nct6116 chip, the driver assigns data->pwm_num to 5, indicating five available PWM channels. Concurrently, it assigns NCT6106 register arrays—specifically NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_*—to data->REG_PWM and data->REG_WEIGHT_TEMP. These specific register arrays contain only 3 elements because the underlying hardware chip only supports weight control on the first three fan control channels.\nDuring execution, the function nct6775_update_pwm() iterates up to data->pwm_num. If data->has_pwm has bits 3 or 4 set, which is structurally possible for the nct6116 chip, the iterative loop attempts to access elements at indices 3 and 4 from the statically defined 3-element arrays. This results in a global out-of-bounds read vulnerability.\nThe attack flow proceeds as the out-of-bounds memory read yields arbitrary garbage values from adjacent global data structures. The driver subsequently uses these out-of-bounds garbage values as valid hardware register addresses during subsequent read and write operations.\nThis leads to invalid hardware register access, which can corrupt unintended hardware states, cause hardware misconfiguration, or trigger kernel exceptions resulting in system crashes. The vulnerable component is the array indexing logic within nct6775_update_pwm() interacting with data->REG_PWM and data->REG_WEIGHT_TEMP.\nThe vulnerability requires local execution context with sufficient privileges to interact with hardware sensors or load the driver, and network exposure is not applicable as the attack vector is strictly local and kernel-based."
}