CVE-2026-72396 (GCVE-0-2026-72396)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-08-17 05:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: adm1275: Prevent reading uninitialized stack
While adding support for the ROHM BD127X0 hot-swap controllers, sashiko
reported an error in device-name comparison, which can lead to reading
uninitialized stack memory.
Quoting Sashiko:
This is a pre-existing issue, but I noticed that just before this block in
adm1275_probe(), there might be an out-of-bounds stack read:
ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer);
if (ret < 0) { ... }
for (mid = adm1275_id; mid->name[0]; mid++) {
if (!strncasecmp(mid->name, block_buffer, strlen(mid->name)))
break;
}
Since i2c_smbus_read_block_data() reads up to 32 bytes into the
uninitialized stack array block_buffer without appending a null
terminator, strncasecmp() could read past the valid bytes returned in ret.
For example, if the device returns a shorter string like "adm12", checking
it against "adm1275" up to the length of "adm1275" will continue reading
into uninitialized stack bounds.
Prevent reading uninitialized memory by zeroing the stack array.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e Version: 87102808d03948c825c3bdc48316e48f6422fd7e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/adm1275.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57d583f069fa9d3d0c0831e34b967d1f61edae94",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "82e4ab03a6ab9b87667410f5143bc484d7a62bdc",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "c9e04a52663bc6651c06c2427df088b751062bd6",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "39a581bd64a0e91112ec8017a2dd4e70c1336e99",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "aa35cee30686e6be3c890bf741429c5025d55abe",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "36554592e2f5cac16ff8bf73720d38a6d9ef4a20",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "93b96e723bdcba6172a5814262be875abcc5d269",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
},
{
"lessThan": "553f9517813912a5ab661af5504485d96824a61c",
"status": "affected",
"version": "87102808d03948c825c3bdc48316e48f6422fd7e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/adm1275.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: adm1275: Prevent reading uninitialized stack\n\nWhile adding support for the ROHM BD127X0 hot-swap controllers, sashiko\nreported an error in device-name comparison, which can lead to reading\nuninitialized stack memory.\n\nQuoting Sashiko:\n\nThis is a pre-existing issue, but I noticed that just before this block in\nadm1275_probe(), there might be an out-of-bounds stack read:\n\n ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer);\n if (ret \u003c 0) { ... }\n for (mid = adm1275_id; mid-\u003ename[0]; mid++) {\n if (!strncasecmp(mid-\u003ename, block_buffer, strlen(mid-\u003ename)))\n break;\n }\n\nSince i2c_smbus_read_block_data() reads up to 32 bytes into the\nuninitialized stack array block_buffer without appending a null\nterminator, strncasecmp() could read past the valid bytes returned in ret.\n\nFor example, if the device returns a shorter string like \"adm12\", checking\nit against \"adm1275\" up to the length of \"adm1275\" will continue reading\ninto uninitialized stack bounds.\n\nPrevent reading uninitialized memory by zeroing the stack array."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:13:52.535Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57d583f069fa9d3d0c0831e34b967d1f61edae94"
},
{
"url": "https://git.kernel.org/stable/c/82e4ab03a6ab9b87667410f5143bc484d7a62bdc"
},
{
"url": "https://git.kernel.org/stable/c/c9e04a52663bc6651c06c2427df088b751062bd6"
},
{
"url": "https://git.kernel.org/stable/c/39a581bd64a0e91112ec8017a2dd4e70c1336e99"
},
{
"url": "https://git.kernel.org/stable/c/aa35cee30686e6be3c890bf741429c5025d55abe"
},
{
"url": "https://git.kernel.org/stable/c/36554592e2f5cac16ff8bf73720d38a6d9ef4a20"
},
{
"url": "https://git.kernel.org/stable/c/93b96e723bdcba6172a5814262be875abcc5d269"
},
{
"url": "https://git.kernel.org/stable/c/553f9517813912a5ab661af5504485d96824a61c"
}
],
"title": "hwmon: adm1275: Prevent reading uninitialized stack",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72396",
"datePublished": "2026-08-15T05:56:23.067Z",
"dateReserved": "2026-08-09T03:40:39.924Z",
"dateUpdated": "2026-08-17T05:13:52.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…