The Linux kernel function pmbus_data2reg_vid() contains a hardcoded VR11 voltage identifier encoding that ignores the driver-supplied vrm_version. This mismatch means that when a device operating in a non‑VR11 VID mode attempts to set a voltage, the value sent to the PMBus regulator is incorrect. In practice, a request for a modest 200 mV can become a 1080 mV command, potentially over‑volting the hardware. The flaw appears to be an incorrect handling of configuration input.

The flaw exists in the generic PMBus core driver shipped with all versions of the Linux kernel before the upstream fix. Any Linux distribution that delivers such an unpatched kernel, on any hardware platform that exposes a PMBus regulator or a hwmon vout setter and operates with a non‑VR11 VID mode, is potentially affected. Administrators need to verify the kernel version on their systems and whether any PMBus-controlled devices are in use.

The CVSS score of 7.1 denotes a moderate-to-high severity, and the EPSS score of < 1% along with its absence from the CISA KEV catalog suggest that exploitation is unlikely at present. The likely attack vector is local privileged execution – this inference is drawn because altering regulator output requires access to kernel‑level write operations on the PMBus device. If an attacker can run code with such privileges, they could intentionally trigger over‑voltage conditions, leading to hardware damage, data loss, or system instability.