The vulnerability occurs in the Linux kernel’s hwmon pmbus subsystem. In the notification routine, each device attribute is unconditionally cast to a sensor_device_attribute. When the attribute actually belongs to a different structure such as pmbus_samples_reg or pmbus_sensor, the cast causes the code to read an index field that resides past the end or overlapped with other fields. This type confusion can trigger an out‑of‑bounds read, potentially exposing kernel memory to a local attacker, leading to sensitive data disclosure.

The flaw is present in any Linux kernel build that implements the hwmon pmbus module and predates the patch commit 0b121de89a99c54bcf516999b04e8531c84f08d5. No specific kernel versions are listed, so all kernels prior to that commit are considered vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No public exploit has been reported. The weakness is local and requires the attacker to trigger the notification logic on a pmbus device, which typically needs privileged or kernel‑module access. The potential impact is information disclosure rather than remote code execution; the likelihood of exploitation remains uncertain but could be significant for systems with uncontrolled hwmon access.