« Volver al listado

CVE-2026-74685

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ltc4282) Clamp negative current limits

When a negative value is passed to ltc4282_write_curr(), the signed long val is cast directly to u64:

This cast converts negative inputs into large positive values. The subsequent division result overflows the u32 in variable, truncating to a pseudo-random positive value. When this is passed to ltc4282_write_voltage_byte(), it is clamped to the maximum limit instead of zero.

Clamp val to 0 and to the maximum supported upper limit before the cast and assign the result to a 64-bit temporary variable before the division to avoid the underflow and an also possible overflow.

Detalles técnicos trazas, registros y código del informe original
drivers/hwmon/ltc4282.c:ltc4282_write_curr() {
        /* need to pass it in millivolt */
        u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO);
        ...
}

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74685",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "lessThan": "60e06c4dba696173982393252a40ceb7dd2eec18",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "lessThan": "de58b90a4d1417c15b693eb04c0ce6bc925d84c6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "lessThan": "046e56b53c09375ef39903514496aa5508db9729",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "lessThan": "e253dd5f9f6d875a317895bf43ec9534ed7523cb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hwmon/ltc4282.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hwmon/ltc4282.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-22T16:16:42.870",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/046e56b53c09375ef39903514496aa5508db9729",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/60e06c4dba696173982393252a40ceb7dd2eec18",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de58b90a4d1417c15b693eb04c0ce6bc925d84c6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e253dd5f9f6d875a317895bf43ec9534ed7523cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Clamp negative current limits\n\nWhen a negative value is passed to ltc4282_write_curr(), the signed long\nval is cast directly to u64:\n\ndrivers/hwmon/ltc4282.c:ltc4282_write_curr() {\n        /* need to pass it in millivolt */\n        u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO);\n        ...\n}\n\nThis cast converts negative inputs into large positive values. The\nsubsequent division result overflows the u32 in variable, truncating\nto a pseudo-random positive value. When this is passed to\nltc4282_write_voltage_byte(), it is clamped to the maximum limit instead\nof zero.\n\nClamp val to 0 and to the maximum supported upper limit before the cast\nand assign the result to a 64-bit temporary variable before the division\nto avoid the underflow and an also possible overflow."
    }
  ],
  "lastModified": "2026-08-22T16:16:42.870",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}