CVE-2026-74549 - Vulnerability Details

- hwmon: (nct6775-core) Prevent access to unsupported weight registers

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nct6775-core) Prevent access to unsupported weight registers

Sashiko reports:

During initialization of the nct6116 chip, the driver sets data->pwm_num
to 5. However, it assigns several NCT6106 register arrays (such as
NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and
NCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP.
These arrays only contain 3 elements.

In nct6775_update_pwm(), the driver iterates up to data->pwm_num. If
data->has_pwm has bits 3 or 4 set (which is structurally possible for
nct6116), the loop attempts to read elements at index 3 and 4 from these
3-element arrays. This results in a global out-of-bounds read, which can
be caught by KASAN.

Furthermore, the driver uses these garbage out-of-bounds values as
hardware register addresses for subsequent read and write operations. This
leads to invalid hardware register access, potentially causing hardware
misconfiguration or system crashes.

The underlying problem is that the chip does support up to five fan
control channels, but only the first three support weight control.
Fix the problem by extending the affected weight register arrays with
zeroed fields. The driver uses zeroed register addresses to determine
if a register is supported or not, and skips accesses for unsupported
registers.

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Based on the description, the nct6775-core driver incorrectly handles arrays that map PWM weight registers. During initialization, the driver assigns 3‑element arrays to weight register pointers while claiming support for up to five fan channels. When the driver loops over the claimed number of PWM channels, it reads beyond the end of these arrays, producing a global out‑of‑bounds read that KASAN can detect. The out‑of‑bounds values are then used as hardware register addresses, leading to invalid register accesses that can misconfigure the fan controller or crash the system.

Affected Systems

The vulnerability affects Linux kernel installations that load the nct6775-core hardware monitoring driver, which is used on monitoring chips such as the NCT6106 and NCT6116. These chips support up to five fan control channels, but only the first three support weight control. Any Linux kernel version that includes the buggy driver and is deployed on systems with one of these chips is impacted. No specific kernel version range is listed, so all kernels that have not yet received the patch are considered vulnerable.

Risk and Exploitability

The bug is a kernel‑space out‑of‑bounds read with potential to crash the system or misconfigure the fan controller. The CVSS score of 7.8 indicates a high severity. Because the driver operates with kernel privileges, an attacker with local or physical access to the device could trigger the fault by causing the driver to initialize. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed exploits yet. Based on the description, the likely attack vector involves privileged or local execution, possibly during system boot or via manipulation of hardware monitoring interfaces.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 0d11b2a10269ace29832f584d207ff3768f79dc5
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 4a77f1d72c6db04cbbfab0250292ac71fdea5f0a
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 513d847f7a95bbdbeaaf55fb942c38992587734f
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 25b528816f5d83be5236dc182692369e8c9402b0
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 689082a4cb166a7ae9729f7b12339e69fdad6c52
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 1b722740ac5c2b2070f9ba922f4e0f227faf0246
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< 4ad2972ef0e1bd1018ad7a72661a4636ed7daecc
`29c7cb485b321c024dedc168bcbb04451176b163`	affected	< d0b704e569ac3b8416d8e02270cdc9bf830ed395

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[29c7cb485b321c024dedc168bcbb04451176b163,25b528816f5d83be5236dc182692369e8c9402b0)`	affected	code_commit	—
`[29c7cb485b321c024dedc168bcbb04451176b163,689082a4cb166a7ae9729f7b12339e69fdad6c52)`	affected	code_commit	—
`[29c7cb485b321c024dedc168bcbb04451176b163,1b722740ac5c2b2070f9ba922f4e0f227faf0246)`	affected	code_commit	—
`[29c7cb485b321c024dedc168bcbb04451176b163,4ad2972ef0e1bd1018ad7a72661a4636ed7daecc)`	affected	code_commit	—
`[29c7cb485b321c024dedc168bcbb04451176b163,d0b704e569ac3b8416d8e02270cdc9bf830ed395)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.4`	affected	generic	—
`[0,5.4)`	unaffected	generic	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`7.2-rc6`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade your Linux kernel to a release that contains the nct6775-core driver fix, which extends the weight register arrays with zeroed fields.
If an upgrade is not immediately possible, disable the nct6775 driver on affected hardware or prevent the use of the weight register interfaces through sysfs or module configuration.
Enable KASAN or other kernel memory‑safety checks so that any out‑of‑bounds accesses are caught and logged, allowing you to identify and mitigate misconfigurations before a crash occurs.

Generated by OpenCVE AI on August 18, 2026 at 02:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0d11b2a10269ace29832f584d207ff3768f79dc5
https://git.kernel.org/stable/c/1b722740ac5c2b2070f9ba922f4e0f227faf0246
https://git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0
https://git.kernel.org/stable/c/4a77f1d72c6db04cbbfab0250292ac71fdea5f0a
https://git.kernel.org/stable/c/4ad2972ef0e1bd1018ad7a72661a4636ed7daecc
https://git.kernel.org/stable/c/513d847f7a95bbdbeaaf55fb942c38992587734f
https://git.kernel.org/stable/c/689082a4cb166a7ae9729f7b12339e69fdad6c52
https://git.kernel.org/stable/c/d0b704e569ac3b8416d8e02270cdc9bf830ed395
https://lore.kernel.org/linux-cve-announce/2026081550-CVE-2026-74549-8692@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74549
https://www.cve.org/CVERecord?id=CVE-2026-74549

History

Wed, 19 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0d11b2a10269ace29832f584d207ff3768f79dc5 https://git.kernel.org/stable/c/4a77f1d72c6db04cbbfab0250292ac71fdea5f0a https://git.kernel.org/stable/c/513d847f7a95bbdbeaaf55fb942c38992587734f

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026081550-CVE-2026-74549-8692@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74549 https://www.cve.org/CVERecord?id=CVE-2026-74549
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data->pwm_num to 5. However, it assigns several NCT6106 register arrays (such as NCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and NCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP. These arrays only contain 3 elements. In nct6775_update_pwm(), the driver iterates up to data->pwm_num. If data->has_pwm has bits 3 or 4 set (which is structurally possible for nct6116), the loop attempts to read elements at index 3 and 4 from these 3-element arrays. This results in a global out-of-bounds read, which can be caught by KASAN. Furthermore, the driver uses these garbage out-of-bounds values as hardware register addresses for subsequent read and write operations. This leads to invalid hardware register access, potentially causing hardware misconfiguration or system crashes. The underlying problem is that the chip does support up to five fan control channels, but only the first three support weight control. Fix the problem by extending the affected weight register arrays with zeroed fields. The driver uses zeroed register addresses to determine if a register is supported or not, and skips accesses for unsupported registers.
Title		hwmon: (nct6775-core) Prevent access to unsupported weight registers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1b722740ac5c2b2070f9ba922f4e0f227faf0246 https://git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0 https://git.kernel.org/stable/c/4ad2972ef0e1bd1018ad7a72661a4636ed7daecc https://git.kernel.org/stable/c/689082a4cb166a7ae9729f7b12339e69fdad6c52 https://git.kernel.org/stable/c/d0b704e569ac3b8416d8e02270cdc9bf830ed395

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:56.993Z

Updated: 2026-08-19T16:38:42.442Z

Reserved: 2026-08-15T05:44:03.915Z

Link: CVE-2026-74549

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:18:00.270

Modified: 2026-08-19T17:21:09.840

Link: CVE-2026-74549

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74549 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T03:00:09Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object