hwmon: (nct6775-core) Prevent access to unsupported weight registers

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74549
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 13:18:00 UTC
Updated2026-08-15 13:18:00 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data->pwm_num to 5. However, it assigns several NCT6106 register arrays (such as NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP. These arrays only contain 3 elements. In nct6775_update_pwm(), the driver iterates up to data->pwm_num. If data->has_pwm has bits 3 or 4 set (which is structurally possible for nct6116), the loop attempts to read elements at index 3 and 4 from these 3-element arrays. This results in a global out-of-bounds read, which can be caught by KASAN. Furthermore, the driver uses these garbage out-of-bounds values as hardware register addresses for subsequent read and write operations. This leads to invalid hardware register access, potentially causing hardware misconfiguration or system crashes. The underlying problem is that the chip does support up to five fan control channels, but only the first three support weight control. Fix the problem by extending the affected weight register arrays with zeroed fields. The driver uses zeroed register addresses to determine if a register is supported or not, and skips accesses for unsupported registers.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 29c7cb485b321c024dedc168bcbb04451176b163 25b528816f5d83be5236dc182692369e8c9402b0 git Not specified
CNA Linux Linux affected 29c7cb485b321c024dedc168bcbb04451176b163 689082a4cb166a7ae9729f7b12339e69fdad6c52 git Not specified
CNA Linux Linux affected 29c7cb485b321c024dedc168bcbb04451176b163 1b722740ac5c2b2070f9ba922f4e0f227faf0246 git Not specified
CNA Linux Linux affected 29c7cb485b321c024dedc168bcbb04451176b163 4ad2972ef0e1bd1018ad7a72661a4636ed7daecc git Not specified
CNA Linux Linux affected 29c7cb485b321c024dedc168bcbb04451176b163 d0b704e569ac3b8416d8e02270cdc9bf830ed395 git Not specified
CNA Linux Linux affected 5.4 Not specified
CNA Linux Linux unaffected 5.4 semver Not specified
CNA Linux Linux unaffected 6.6.151 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.103 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.44 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.8 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc6 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4ad2972ef0e1bd1018ad7a72661a4636ed7daecc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d0b704e569ac3b8416d8e02270cdc9bf830ed395 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/689082a4cb166a7ae9729f7b12339e69fdad6c52 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1b722740ac5c2b2070f9ba922f4e0f227faf0246 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report