CVE-2026-98199

What it actually does

Insufficient phase limit in the pmbus hwmon core allows out-of-bounds writes when drivers such as mp2975 (14 phases) or mp2856 (12 phases) probe devices reporting more phases than the original maximum.

Why it matters to the business

Kernel memory corruption on systems using affected PMBus power-management chips can cause crashes, instability, or local privilege escalation, disrupting servers and embedded devices until the kernel is updated.

How an attack unfolds

An attacker with local access loads or triggers the pmbus driver on hardware containing mp2975 or mp2856 chips; during probe the driver writes beyond allocated phase structures, corrupting kernel memory.

How to fix it

Apply the upstream patch that raises the phase count to 16 and adds the new voltage-source mask; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains the commit that increases PHASE count to 16 and verify no OOB accesses occur during pmbus probe of mp2975/mp2856 devices.

Typical attack path

1. Obtain local shell or user context on target system
2. Trigger pmbus driver probe via hardware presence or module load
3. Chip reports phase count exceeding the old limit
4. Driver performs out-of-bounds write during initialization
5. Kernel memory corruption leads to crash or code execution

How to detect it

Review kernel logs for pmbus-related oops, slab-out-of-bounds warnings, or panics during driver initialization; correlate with presence of mp2975 or mp2856 modules.

What your security team should do

• Prioritize kernel update on any host exposing PMBus sensors
• Monitor for kernel oops or panic logs referencing pmbus during boot or module load
• Restrict unprivileged module loading until patches are applied