CVE-2026-99022 - Vulnerability Details

- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

Description

In the Linux kernel, the following vulnerability has been resolved:

regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST
triggers a hard reset of the chip and writing CLIRQ clears the interrupt;
reading them returns nothing useful, and the read itself fires the command.

The result is that a plain register dump resets the board:

cat /sys/kernel/debug/regmap/2-003c/registers

walks every readable register, hits HRST, and the board reboots.

Split the callback back in two so HRST and CLIRQ stay writable but are no
longer readable. The readable range is left unchanged
(LTC3676_BUCK1 ... LTC3676_IRQSTAT).

Published: 2026-10-23

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Reading the HRST or CLIRQ registers of the LTC3676 regulator in the Linux kernel triggers a hard reset or clears interrupts. These registers are write‑only command strobes, but a read operation also fires the command. A full register dump of the chip therefore causes the board to reboot, which is a denial‑of‑service to any software running on top of the kernel.

Affected Systems

The vulnerability affects all Linux kernel builds that include the LTC3676 regulator driver before the fix. No specific version numbers are provided, but all kernels containing the affected code are susceptible.

Risk and Exploitability

The flaw is local: an attacker with read access to the kernel debug filesystem (/sys/kernel/debug/) can trigger the reset. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, but the impact—a sudden reboot—can have severe operational consequences. The CVSS score of 4.4 indicates a moderate severity, yet the availability of debugfs access makes exploitation straightforward for local privileged users.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< 4cc1e849bb7dd8deb37f6a51e1aaf725e2016595
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< 0893de2397d85547d4b88379044aa541b07b56af
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< f8b0ccdcf3ca7cf6e4c2c400e80f81a727f768c7
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< fd376d83741118e0212f0da985889c1a98d9c827
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< 1fb0d58fd363b439b4faf08a16ee6ae38b575cd4
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< 199a62d70314d21f06a9a6faaa3ef54d0404910c
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< ca5d85335a8fa6e87b45629f1a07b412482cab17
`37b918a034feda1b1ef404acf003812f37ab8da2`	affected	< 28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83

Linux

affected

Version	Status	Constraints
`4.9`	affected	—
`0`	unaffected	< 4.9
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[37b918a034feda1b1ef404acf003812f37ab8da2,fd376d83741118e0212f0da985889c1a98d9c827)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,1fb0d58fd363b439b4faf08a16ee6ae38b575cd4)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,199a62d70314d21f06a9a6faaa3ef54d0404910c)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,ca5d85335a8fa6e87b45629f1a07b412482cab17)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`4.9`	affected	generic	—
`[0,4.9)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[37b918a034feda1b1ef404acf003812f37ab8da2,fd376d83741118e0212f0da985889c1a98d9c827)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,1fb0d58fd363b439b4faf08a16ee6ae38b575cd4)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,199a62d70314d21f06a9a6faaa3ef54d0404910c)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,ca5d85335a8fa6e87b45629f1a07b412482cab17)`	affected	code_commit	—
`[37b918a034feda1b1ef404acf003812f37ab8da2,28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.9`	affected	generic	—
`[0,4.9)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the patch removing read access to HRST and CLIRQ registers.
Disable or restrict access to the kernel debug filesystem so that only trusted users can read /sys/kernel/debug/debugfs and avoid automatic register dumps.
Remove or modify any scripts that perform full register dumps of the LTC3676 device to prevent accidental reboots.

Generated by OpenCVE AI on October 29, 2026 at 19:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99022.mbox
https://git.kernel.org/stable/c/0893de2397d85547d4b88379044aa541b07b56af
https://git.kernel.org/stable/c/199a62d70314d21f06a9a6faaa3ef54d0404910c
https://git.kernel.org/stable/c/1fb0d58fd363b439b4faf08a16ee6ae38b575cd4
https://git.kernel.org/stable/c/28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83
https://git.kernel.org/stable/c/4cc1e849bb7dd8deb37f6a51e1aaf725e2016595
https://git.kernel.org/stable/c/ca5d85335a8fa6e87b45629f1a07b412482cab17
https://git.kernel.org/stable/c/f8b0ccdcf3ca7cf6e4c2c400e80f81a727f768c7
https://git.kernel.org/stable/c/fd376d83741118e0212f0da985889c1a98d9c827
https://nvd.nist.gov/vuln/detail/CVE-2026-99022
https://www.cve.org/CVERecord?id=CVE-2026-99022

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0893de2397d85547d4b88379044aa541b07b56af https://git.kernel.org/stable/c/4cc1e849bb7dd8deb37f6a51e1aaf725e2016595 https://git.kernel.org/stable/c/f8b0ccdcf3ca7cf6e4c2c400e80f81a727f768c7

Thu, 29 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-78

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-749
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99022.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99022 https://www.cve.org/CVERecord?id=CVE-2026-99022
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 24 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-78

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them returns nothing useful, and the read itself fires the command. The result is that a plain register dump resets the board: cat /sys/kernel/debug/regmap/2-003c/registers walks every readable register, hits HRST, and the board reboots. Split the callback back in two so HRST and CLIRQ stay writable but are no longer readable. The readable range is left unchanged (LTC3676_BUCK1 ... LTC3676_IRQSTAT).
Title		regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/199a62d70314d21f06a9a6faaa3ef54d0404910c https://git.kernel.org/stable/c/1fb0d58fd363b439b4faf08a16ee6ae38b575cd4 https://git.kernel.org/stable/c/28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83 https://git.kernel.org/stable/c/ca5d85335a8fa6e87b45629f1a07b412482cab17 https://git.kernel.org/stable/c/fd376d83741118e0212f0da985889c1a98d9c827

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:21:03.138Z

Updated: 2026-10-30T12:40:59.813Z

Reserved: 2026-09-25T10:25:14.386Z

Link: CVE-2026-99022

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:25.127

Modified: 2026-10-30T13:21:38.500

Link: CVE-2026-99022

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99022 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T19:15:08Z

Weaknesses

CWE-749
Exposed Dangerous Method or Function

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object