CVE-2026-80696

What it actually does

Missing return statement causes out-of-bounds memory access when reading minimum alarm voltage for the VGPIO channel in the ltc4282 hwmon driver.

Why it matters to the business

Local users on affected Linux systems can trigger kernel memory corruption, leading to crashes, data corruption, or potential privilege escalation that disrupts operations or compromises the host.

How an attack unfolds

A local attacker with access to the hwmon sysfs interface triggers the VGPIO minimum alarm voltage read path; the absent return allows the function to continue into invalid memory, enabling out-of-bounds read or write operations that may be leveraged for further exploitation.

How to fix it

Apply the upstream kernel patch that adds the missing return statement in the ltc4282 driver; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Inspect the ltc4282 driver source for the added return statement after the out-of-bounds check and confirm the fixed kernel version is running via uname or package manager.

Typical attack path

1. Obtain local user access on a system exposing the ltc4282 hwmon device
2. Interact with the VGPIO channel sysfs attributes to read minimum alarm voltage
3. Trigger the code path lacking the return statement to perform out-of-bounds access
4. Leverage resulting memory corruption for denial of service or privilege escalation

How to detect it

Review kernel logs and dmesg for oops/panic messages referencing ltc4282 and voltage alarm reads; inspect audit logs for unusual sysfs access to VGPIO attributes.

What your security team should do

• Prioritize patching systems that expose the ltc4282 hwmon driver to untrusted local users
• Restrict unprivileged access to hwmon sysfs interfaces until patches are applied
• Monitor kernel logs for oops or panic entries related to ltc4282 voltage reads