CVE-2026-74685 (GCVE-0-2026-74685)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-22 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ltc4282) Clamp negative current limits
When a negative value is passed to ltc4282_write_curr(), the signed long
val is cast directly to u64:
drivers/hwmon/ltc4282.c:ltc4282_write_curr() {
/* need to pass it in millivolt */
u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO);
...
}
This cast converts negative inputs into large positive values. The
subsequent division result overflows the u32 in variable, truncating
to a pseudo-random positive value. When this is passed to
ltc4282_write_voltage_byte(), it is clamped to the maximum limit instead
of zero.
Clamp val to 0 and to the maximum supported upper limit before the cast
and assign the result to a 64-bit temporary variable before the division
to avoid the underflow and an also possible overflow.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/ltc4282.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "60e06c4dba696173982393252a40ceb7dd2eec18",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
},
{
"lessThan": "de58b90a4d1417c15b693eb04c0ce6bc925d84c6",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
},
{
"lessThan": "046e56b53c09375ef39903514496aa5508db9729",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
},
{
"lessThan": "e253dd5f9f6d875a317895bf43ec9534ed7523cb",
"status": "affected",
"version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/ltc4282.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Clamp negative current limits\n\nWhen a negative value is passed to ltc4282_write_curr(), the signed long\nval is cast directly to u64:\n\ndrivers/hwmon/ltc4282.c:ltc4282_write_curr() {\n /* need to pass it in millivolt */\n u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st-\u003ersense, DECA * MICRO);\n ...\n}\n\nThis cast converts negative inputs into large positive values. The\nsubsequent division result overflows the u32 in variable, truncating\nto a pseudo-random positive value. When this is passed to\nltc4282_write_voltage_byte(), it is clamped to the maximum limit instead\nof zero.\n\nClamp val to 0 and to the maximum supported upper limit before the cast\nand assign the result to a 64-bit temporary variable before the division\nto avoid the underflow and an also possible overflow."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:32:51.493Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/60e06c4dba696173982393252a40ceb7dd2eec18"
},
{
"url": "https://git.kernel.org/stable/c/de58b90a4d1417c15b693eb04c0ce6bc925d84c6"
},
{
"url": "https://git.kernel.org/stable/c/046e56b53c09375ef39903514496aa5508db9729"
},
{
"url": "https://git.kernel.org/stable/c/e253dd5f9f6d875a317895bf43ec9534ed7523cb"
}
],
"title": "hwmon: (ltc4282) Clamp negative current limits",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74685",
"datePublished": "2026-08-22T15:32:51.493Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-08-22T15:32:51.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…