CVE-2026-80745 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users who rely on the Linux kernel for their systems, should be aware of this vulnerability. They should review and apply the provided patches to prevent potential exploitation. Additionally, security teams and vulnerability management teams should be informed about this vulnerability and its potential impact on their systems. They should also verify the VPOSNEG_table[] mapping against the FP9931 datasheet to ensure accuracy and monitor the Linux kernel for any future updates or patches related to this vulnerability. Affected product deployments should be identified and assigned an owner for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. This should be done with a focus on affected operator, platform, vulnerability-management, and security-team impact, ensuring that all relevant parties are aware of the vulnerability and its potential impact on their systems, and that appropriate actions are taken to mitigate the risk. This includes verifying the accuracy of the VPOSNEG_table[] mapping and ensuring that all necessary patches are applied. Furthermore, asset inventory and rollback/change windows should be considered to minimize potential disruptions. Source tracking should also be implemented to monitor for any future updates or patches related to this vulnerability. By taking these steps, organizations can help ensure that their systems are protected from potential exploitation of this vulnerability. The vulnerability's high CVSS score of 8.4 emphasizes the importance of prompt action to mitigate its risk. Linux kernel developers and maintainers should prioritize reviewing and applying patches, while users who rely on the Linux kernel should ensure that their systems are updated and verified against the FP9931 datasheet. Security teams should also review compensating controls and monitoring to ensure that exposed systems are properly secured

Technical summary

The vulnerability is related to the regulator: fp9931 module in the Linux kernel. The VPOSNEG_table[] mapping does not match the FP9931 datasheet, which can cause issues with voltage selector tables. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h -> 7.04V (-7.04V), 05h -> 7.26V (-7.26V), 06h -> 7.49V (-7.49V), ... , 28h-3Fh -> 15.06V (-15.06V). However, VPOSNEG_table[] has two issues: a duplicate 7.04V entry and insufficient clamped 15.06V entries.

Defensive priority

This vulnerability has a high CVSS score of 8.4 and is related to the Linux kernel. It is recommended to review and apply the provided patches to prevent potential exploitation.

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel to prevent potential exploitation.
• Verify the VPOSNEG_table[] mapping against the FP9931 datasheet to ensure accuracy.
• Monitor the Linux kernel for any future updates or patches related to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is related to the regulator: fp9931 module in the Linux kernel. The VPOSNEG_table[] mapping does not match the FP9931 datasheet, which can cause issues with voltage selector tables. The datasheet defines the VPOS/VNEG voltage mapping, but the VPOSNEG_table[] has two issues: a duplicate 7.04V entry and insufficient clamped 15.06V entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.