CVE-2024-46756

What it actually does

The vulnerability is an improper input validation flaw in the Linux kernel w83627ehf hwmon driver where kstrtol() followed by DIV_ROUND_CLOSEST() on a large negative value such as -9223372036854775808 produces an integer underflow before clamp_val() is applied.

Why it matters to the business

Systems running the affected Linux kernel on Debian 11 may experience hardware monitoring failures or instability when untrusted local users interact with limit attributes, increasing operational risk until the package is updated to 5.10.226-1.

How an attack unfolds

A local attacker identifies a w83627ehf hwmon device via sysfs, writes a crafted large negative value to a limit attribute, and triggers the underflow due to the incorrect ordering of arithmetic and clamping operations.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.226-1 or newer; verify the hwmon driver source contains the reordered clamp_val() before DIV_ROUND_CLOSEST() operations.

How to confirm the fix worked

Confirm the installed kernel package version is at least 5.10.226-1 and test that writing large negative values to hwmon limit attributes no longer produces underflow or unexpected results.

Typical attack path

1. Obtain local shell or process execution on an affected Debian 11 system
2. Locate the w83627ehf hwmon sysfs entries
3. Write a large negative numeric string to a limit attribute file
4. Observe resulting underflow in driver calculations

How to detect it

Review system and audit logs for unusual write attempts to hwmon sysfs limit files and inspect kernel oops or underflow warnings referencing w83627ehf.

What your security team should do

• Apply the linux 5.10.226-1 update on all Debian 11 systems without delay
• Restrict unprivileged write access to hwmon sysfs attributes where possible
• Monitor upstream kernel changelogs for related hwmon fixes