CVE-2024-26730

What it actually does

Out-of-bounds access to temperature configuration registers in the nct6775 hwmon driver during probe, reported as global-out-of-bounds by KASAN when the number of config registers does not match temperature registers.

Why it matters to the business

Potential kernel stability issues or crashes on Linux systems using affected NCT6775 chips; low urgency given absence from KEV and minimal EPSS with no observed exploitation trend.

How an attack unfolds

An attacker would need local access to trigger loading or probing of the nct6775 driver on vulnerable hardware configurations, leading to the bounds violation during nct6775_probe; no known threat actors or ransomware campaigns associated.

How to fix it

Update the Linux kernel to the fixed commit f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f or later stable releases containing the patch.

How to confirm the fix worked

Verify the applied kernel contains commit f006c45a3ea424f8f6c8e4b9283bc245ce2a4d0f and confirm absence of KASAN global-out-of-bounds reports referencing nct6775_probe on affected hardware.

Typical attack path

1. Obtain local access to a system with nct6775 hardware
2. Trigger driver probe or module load
3. Cause access to mismatched temperature configuration registers

How to detect it

Search kernel logs and KASAN reports for strings referencing nct6775_probe and global-out-of-bounds access during driver initialization.

• BUG: KASAN: global-out-of-bounds in nct6775_probe+0x5654/0x6fe9
• nct6775_probe

What your security team should do

• Prioritize kernel updates on systems using nct6775 hardware monitoring
• Enable KASAN in test environments to validate the fix
• Monitor upstream stable kernel releases for backports