Cloudanix VulnDB

CVE-2026-99022

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A debugging feature in the Linux kernel can accidentally restart certain devices when someone looks at internal power-management registers.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

A debugfs register dump in the ltc3676 regulator driver reads write-only command registers (HRST at 0x1e, CLIRQ at 0x1f), triggering an unintended hard reset of the regulator and rebooting the system.

Why it matters to the business

Accidental system reboots during routine debugging or monitoring disrupt operations and availability on affected embedded Linux devices using the LTC3676 PMIC.

How an attack unfolds

An attacker or unprivileged user with access to the debugfs interface runs a command that iterates over readable registers, causing the driver to read the HRST register and reset the board.

How to fix it

Update the Linux kernel to a version containing the fix that splits the regmap callback so HRST and CLIRQ remain writable but are excluded from read operations.

How to confirm the fix worked

Confirm the regmap callbacks have been split, test that reading the debugfs registers file no longer triggers a reset, and verify the readable range remains LTC3676_BUCK1 to LTC3676_IRQSTAT.

Typical attack path

  1. Locate the regmap debugfs entry for the ltc3676 device (e.g., /sys/kernel/debug/regmap/*/registers)
  2. Execute a read operation that walks all registers (cat, hexdump, or similar)
  3. Driver issues read to HRST register
  4. Hardware performs hard reset
  5. System reboots

How to detect it

Look in system logs for sudden reboots immediately after access to regulator debugfs entries; correlate with kernel messages referencing regmap or ltc3676.

What your security team should do

  • Apply the upstream kernel fix as soon as it is available in your distribution
  • Restrict access to /sys/kernel/debug/regmap to root only
  • Monitor for unexpected reboots correlated with regulator debug access

The record

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them returns nothing useful, and the read itself fires the command. The result is that a plain register dump resets the board: cat /sys/kernel/debug/regmap/2-003c/registers walks every readable register, hits HRST, and the board reboots. Split the callback back in two so HRST and CLIRQ stay writable but are no longer readable. The readable range is left unchanged (LTC3676_BUCK1 ... LTC3676_IRQSTAT).

Affected packages

Ecosystem Package Introduced Fixed