CVE-2026-43380

{"id": "CVE-2026-43380", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "a0fc1b9c738fba231f190ab960c83202722efee5", "versionType": "git"}, {"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "c59090c50f62a17129fc4c5407bc4071305a9e82", "versionType": "git"}, {"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "52db5ef163c96f916d424e472fb17aadc35a9f7a", "versionType": "git"}, {"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "b48a0f8d4541a4f6651dc9a64430ce9fdf5c120b", "versionType": "git"}, {"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "73a7a345816946d276ad2c46c8bb771de67cfc46", "versionType": "git"}, {"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "24a7b9daa103fa963b3fd37d8805b23e01621976", "versionType": "git"}, {"status": "affected", "version": "d014538aa38561cd24c5eb228223585f26c5ec71", "lessThan": "25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43", "versionType": "git"}], "programFiles": ["drivers/hwmon/pmbus/q54sj108a2.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.19", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/hwmon/pmbus/q54sj108a2.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T15:16:49.207", "references": [{"url": "https://git.kernel.org/stable/c/24a7b9daa103fa963b3fd37d8805b23e01621976", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/52db5ef163c96f916d424e472fb17aadc35a9f7a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/73a7a345816946d276ad2c46c8bb771de67cfc46", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a0fc1b9c738fba231f190ab960c83202722efee5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b48a0f8d4541a4f6651dc9a64430ce9fdf5c120b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c59090c50f62a17129fc4c5407bc4071305a9e82", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read\n\nThe q54sj108a2_debugfs_read function suffers from a stack buffer overflow\ndue to incorrect arguments passed to bin2hex(). The function currently\npasses 'data' as the destination and 'data_char' as the source.\n\nBecause bin2hex() converts each input byte into two hex characters, a\n32-byte block read results in 64 bytes of output. Since 'data' is only\n34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end\nof the buffer onto the stack.\n\nAdditionally, the arguments were swapped: it was reading from the\nzero-initialized 'data_char' and writing to 'data', resulting in\nall-zero output regardless of the actual I2C read.\n\nFix this by:\n1. Expanding 'data_char' to 66 bytes to safely hold the hex output.\n2. Correcting the bin2hex() argument order and using the actual read count.\n3. Using a pointer to select the correct output buffer for the final\n simple_read_from_buffer call."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhwmon: (pmbus/q54sj108a2) corrige desbordamiento de pila en la lectura de debugfs\n\nLa funci\u00f3n q54sj108a2_debugfs_read sufre de un desbordamiento de b\u00fafer de pila debido a argumentos incorrectos pasados a bin2hex(). La funci\u00f3n actualmente pasa \u2019data\u2019 como destino y \u2019data_char\u2019 como origen.\n\nDebido a que bin2hex() convierte cada byte de entrada en dos caracteres hexadecimales, una lectura de bloque de 32 bytes resulta en 64 bytes de salida. Dado que \u2019data\u2019 es de solo 34 bytes (I2C_SMBUS_BLOCK_MAX + 2), esto escribe 30 bytes m\u00e1s all\u00e1 del final del b\u00fafer en la pila.\n\nAdem\u00e1s, los argumentos estaban intercambiados: estaba leyendo de \u2019data_char\u2019 inicializado a cero y escribiendo en \u2019data\u2019, lo que resultaba en una salida de todo ceros independientemente de la lectura I2C real.\n\nEsto se soluciona mediante:\n1. Expandiendo \u2019data_char\u2019 a 66 bytes para contener de forma segura la salida hexadecimal.\n2. Corrigiendo el orden de los argumentos de bin2hex() y usando el recuento de lectura real.\n3. Usando un puntero para seleccionar el b\u00fafer de salida correcto para la llamada final a simple_read_from_buffer."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}