CVE-2026-72397 Linux CVE debrief

Who should care

System administrators and developers working with Linux kernel-based systems, particularly those using pmbus and VID modes, should review and apply the patch to prevent potential issues. Additionally, security teams and vulnerability management professionals should be aware of the potential impact of this vulnerability on their systems and take steps to verify and mitigate exposure. Operators of systems using the affected Linux kernel configurations should also be aware of the potential risks and take proactive measures to ensure system security and stability. This includes reviewing system configurations, monitoring system logs, and verifying the implementation of the patch.

Technical summary

The pmbus_data2reg_vid() function in the Linux kernel was modified to correctly handle vrm_version configurations. Previously, it hardcoded the VR11 encoding, which could lead to incorrect codes being sent to PMBUS_VOUT_COMMAND. This change ensures that drivers using non-VR11 VID modes will now correctly calculate and send codes. The technical impact of this vulnerability is significant, as it could result in dangerously wrong codes being sent to PMBUS_VOUT_COMMAND, potentially leading to system instability or incorrect voltage regulation. The fix addresses this issue by making the function configurable and aware of different VID modes.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch to ensure the fix is implemented
• Verify system configurations and VID modes to prevent incorrect codes from being sent to PMBUS_VOUT_COMMAND
• Monitor system logs for potential issues related to the vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis is required to fully understand the impact and affected systems. The pmbus_data2reg_vid() function's modification to honor vrm_version configurations is crucial. Defenders should verify system configurations, VID modes, and potential exposure to incorrect codes being sent to PMBUS_VOUT_COMMAND. Additionally, reviewing the Linux kernel patch and its implications on system operations is essential. The lack of detailed information on affected products and components necessitates a thorough review of system dependencies and potential vulnerabilities.

Official resources