Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missing return statement to fix the problem.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:55.090Z",
  "pubdate": "2026-08-28T08:16:55.090Z",
  "executiveSummary": "A memory safety vulnerability exists in the Linux kernel ltc4282 hardware monitoring driver. The flaw is identified as an out-of-bounds (OOB) memory access occurring during the retrieval of minimum alarm voltage thresholds for the VGPIO channel.\nThis vulnerability is categorized as an improper bounds check, potentially leading to kernel memory corruption or an information leak depending on the surrounding memory layout.\nThe issue affects systems utilizing the ltc4282 driver for power management and monitoring. An attacker capable of triggering a read operation on the affected alarm register could cause the kernel to access unauthorized memory addresses.\nWhile exploitation requires local user access, the impact could range from system instability and kernel panics (denial of service) to the disclosure of sensitive kernel stack or heap memory content.\nRemediation requires the application of the specific kernel patch that enforces proper control flow during the register read sequence, ensuring function termination following a valid data retrieval.",
  "technicalDetails": "The vulnerability resides within the ltc4282_read_alarm function of the Linux kernel's hwmon ltc4282 driver. The root cause is a logic error where the code path fails to return execution control after processing the VGPIO channel's alarm register.\nWhen a user or process requests the minimum alarm voltage status for the VGPIO channel, the driver logic executes an index-based lookup to fetch the corresponding alarm threshold. Due to the absence of an explicit return statement, the execution flow proceeds to subsequent instructions that attempt to index into an array or memory structure using an unvalidated or offset index.\nAs identified by static analysis tool Coverity, this execution flow leads to an OOB read. Specifically, the function continues past the intended logic block, effectively using the results of previous calculations or residual register states to perform an out-of-bounds memory access. This behavior violates the integrity of the function’s state machine.\nIn a typical attack scenario, an unprivileged user with access to sysfs or other hardware monitoring interfaces could issue a read request to the affected hwmon attribute. Because the function fails to exit, the driver processes memory segments beyond the intended bounds of the data structure containing the voltage thresholds.\nThe impact of this OOB access depends on the architecture and current kernel memory layout. At a minimum, this triggers a kernel panic or an oops, resulting in a denial-of-service condition. In more sophisticated scenarios, if the read operations are observable or influence subsequent kernel operations, it may facilitate an information leak by exposing sensitive kernel data structures to userspace.\nThe vulnerability is limited to the ltc4282 driver component and is reachable through the standard Linux hardware monitoring subsystem. No complex remote exploitation network vector is required; the primary constraint is the ability to interact with the sysfs interface provided by the kernel. Because the kernel executes the driver code in a high-privilege context, the resulting OOB read operates with the full authority of the kernel, making the memory corruption or access bypass potentially significant for system stability."
}