CVE-2026-46007hwmon: (powerz) Avoid cacheline sharing for DMA buffer
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Avoid cacheline sharing for DMA buffer Depending on the architecture the transfer buffer may share a cacheline with the following mutex. As the buffer may be used for DMA, that is problematic. Use the high-level DMA helpers to make sure that cacheline sharing can not happen. Also drop the comment, as the helpers are documentation enough. https://sashiko.dev/#/message/20260408175814.934BFC19421%40smtp.kernel.org
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Jun 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4381a36abdf1c5c0323c1c51f869dc000115eb20 builds before 270e5c576a6e30f6b337fa91d35b44c241297533; 4381a36abdf1c5c0323c1c51f869dc000115eb20 builds before 1869da3efe703b016b23d4885f3fe6c1751959c6; 4381a36abdf1c5c0323c1c51f869dc000115eb20 builds before 2fa2273016a0483217404cfe330967c4ac6832a9; 4381a36abdf1c5c0323c1c51f869dc000115eb20 builds before 3023c050af3600bf451153335dea5e073c9a3088 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.4 | NVD |
References
- https://git.kernel.org/stable/c/270e5c576a6e30f6b337fa91d35b44c241297533patch
- https://git.kernel.org/stable/c/1869da3efe703b016b23d4885f3fe6c1751959c6patch
- https://git.kernel.org/stable/c/2fa2273016a0483217404cfe330967c4ac6832a9patch
- https://git.kernel.org/stable/c/3023c050af3600bf451153335dea5e073c9a3088patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.