CVE-2026-72395: hwmon: (pmbus) Fix passing events to regulator core

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-15 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator events over time using atomic_or(). The delayed worker then passes the combined bitmask unmodified to regulator_notifier_call_chain(). The core regulator subsystem's regulator_handle_critical() function evaluates the event parameter using a strict switch statement. If multiple distinct faults occur before the worker runs (e.g., REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined bitmask fails to match any case. This leaves the reason as NULL and completely bypasses the critical hw_protection_trigger(). Fix the problem by passing events bit by bit to the regulator event handler.

Affected products

Linux: from 6.6.143 before 6.6.145; from 6.12.92 before 6.12.97; from 6.18.21 before 6.18.40; from 6.1.191 before 6.2; from 6.19.11 before 6.20 — fixed in 6.6.145, 6.12.97, 6.18.40, 6.2, 6.20

How to fix

Upgrade to a fixed version: Linux 6.6.145, 6.12.97, 6.18.40, 6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-72395 or the next vulnerability affects your stack