PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46007 Linux CVE debrief

This CVE addresses a cache coherency vulnerability in the Linux kernel's hwmon (hardware monitoring) subsystem, specifically within the powerz driver. The issue stems from a DMA buffer potentially sharing a cacheline with an adjacent mutex, which can lead to data corruption or undefined behavior on architectures where cache coherency between CPU and DMA operations is not automatically maintained. The resolution employs high-level DMA helper functions to ensure proper cacheline alignment and isolation of the DMA buffer from other data structures.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

System administrators running Linux on architectures with non-coherent DMA (certain ARM, MIPS, or other embedded platforms); kernel maintainers and distributors backporting stable fixes; security teams tracking kernel memory safety improvements

Technical summary

The powerz driver in the Linux kernel hwmon subsystem used a transfer buffer for DMA operations that could share a cacheline with a following mutex structure. On architectures without automatic cache coherency between CPU and DMA, this arrangement creates a race condition where CPU cache writes to the mutex could interfere with DMA operations on the buffer, or vice versa. The fix replaces manual buffer management with high-level DMA helper functions that guarantee cacheline alignment and prevent sharing between DMA-accessible memory and other kernel data structures. This is a defensive programming fix that eliminates a class of potential memory corruption issues on affected hardware platforms.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available through distribution channels
  • Monitor NVD for CVSS scoring and CWE classification once analysis is complete
  • Review systems using the powerz hardware monitoring driver for kernel version exposure
  • Validate cache coherency configurations on affected architectures if running custom kernel builds

Evidence notes

The vulnerability description indicates this is a resolved issue in the Linux kernel hwmon powerz driver. The fix involves using DMA helper functions to prevent cacheline sharing between DMA buffers and mutexes. Four kernel.org stable tree commits are referenced, suggesting backports to multiple stable kernel branches. The CVE was published and modified on 2026-05-27, with NVD status 'Awaiting Analysis' indicating ongoing assessment. No CVSS score or severity has been assigned by NVD at this time.

Official resources

2026-05-27