CVE-2026-80696

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only by a local read(2) on /sys/class/hwmon/hwmonN/in2_min_alarm (sysfs -> hwmon_attr_show -> ltc4282_read -> ltc4282_read_in); the LTC4282 I2C hwmon driver has no network, wireless, or direct physical-bus attack surface.

AC:LAttack complexity, low

On systems with an LTC4282 bound, any read of in2_min_alarm deterministically executes the missing-return fallthrough and out-of-bounds in0_1_cache[2].en access; the attacker fully controls triggering with no race or conditions outside their control.

PR:LPrivileges required, low

in2_min_alarm is exposed as mode 0444 with no capability checks beyond standard sysfs permissions, so any unprivileged local user on a host with LTC4282 hardware can invoke the vulnerable read path without init-namespace root or user-namespace privileges.

UI:NUser interaction, none

Exploitation requires only the attacker (or attacker-controlled monitoring software) to read the hwmon sysfs attribute; no separate victim action such as plugging hardware, mounting filesystems, or approving prompts is needed.

S:UScope, unchanged

The out-of-bounds read and conditional hardware alarm-bit clearing remain within the host kernel/driver context managing the local LTC4282; they do not cross VM, container, IOMMU, or other changed security-authority boundaries.

C:HConfidentiality impact, high

The fallthrough indexes in0_1_cache[2] past the two-element array, performing an out-of-bounds read of adjacent ltc4282_state memory (energy_en/padding) that steers control flow and can return incorrect in2_min_alarm data to userspace.

I:HIntegrity impact, high

When the out-of-bounds .en byte is non-zero, the fallthrough calls __ltc4282_read_alarm() with VSOURCE_ALARM_L_MASK, clearing the VSOURCE undervoltage alarm bit on the live LTC4282 hot-swap controller and corrupting safety-critical power-rail monitoring on datacenter/telecom racks.

A:HAvailability impact, high

Clearing VSOURCE undervoltage alarms on an LTC4282 controlling live backplane/linecard hot-swap power can mask critical rail faults, enabling undetected power events and sustained rack or linecard outages on affected server and industrial deployments.