LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43380: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read The q54sj108a2_debugfs_read function suffers from a stack buffer overflow due to incorrect arguments passed to bin2hex(). The function currently passes 'data' as the destination and 'data_char' as the source. Because bin2hex() converts each input byte into two hex characters, a 32-byte block read results in 64 bytes of output. Since 'data' is only 34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end of the buffer onto the stack. Additionally, the arguments were swapped: it was reading from the zero-initialized 'data_char' and writing to 'data', resulting in all-zero output regardless of the actual I2C read. Fix this by: 1. Expanding 'data_char' to 66 bytes to safely hold the hex output. 2. Correcting the bin2hex() argument order and using the actual read count. 3. Using a pointer to select the correct output buffer for the final simple_read_from_buffer call.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user may be able to trigger a Linux kernel stack overflow when reading a debugfs entry exposed by the q54sj108a2 hardware-monitoring driver. Successful exploitation could potentially compromise confidentiality, integrity, and availability. This is not described as remotely exploitable.

Executive priority

Treat as a high-priority local privilege risk on multi-user, appliance, laboratory, and management systems using this driver. Expedite exposure assessment and normal kernel patching, but avoid declaring an emergency solely from the CVSS score because no active exploitation evidence is supplied.

Technical view

The driver reverses the source and destination arguments to bin2hex(). A 32-byte input therefore produces 64 bytes in a 34-byte stack buffer, overwriting 30 adjacent bytes. The kernel fix enlarges the hexadecimal-output buffer, corrects argument ordering, uses the actual read length, and selects the correct response buffer.

Likely exposure

Exposure is limited to systems running a vulnerable Linux kernel where the q54sj108a2 driver and its debugfs read path are available. The supplied version data is ambiguous, so determine exposure by kernel provenance and inclusion of the referenced stable fix rather than version strings alone.

Exploitation context

The CVSS vector describes local attack access, low privileges, low complexity, and no user interaction. The bundle marks this CVE as absent from KEV and supplies no evidence of active exploitation. Affected systems could nevertheless face kernel-level data disclosure, modification, or disruption if exploitation succeeds.

Researcher notes

The overwrite is deterministic in size for a maximum 32-byte block: hexadecimal expansion produces 64 bytes and exceeds the 34-byte destination by 30 bytes. The reversed arguments also explain the erroneous zero output. The sources do not establish exploit reliability, reachable kernel configurations, or affected distribution packages.

Mitigation direction

  • Install a distribution or vendor kernel update incorporating the referenced stable fix.
  • Prioritize systems where the q54sj108a2 driver and debugfs interface are available.
  • Restrict unnecessary local account access while affected systems await updates.
  • Consult the Linux distributor's advisory for exact fixed package versions and reboot requirements.

Validation and detection

  • Inventory running kernel versions and their distribution package revisions.
  • Determine whether the q54sj108a2 driver is configured, loaded, or used.
  • Check whether relevant debugfs entries are present and accessible to low-privileged users.
  • Confirm the installed kernel contains the applicable referenced stable commit.
  • After updating, verify the fixed kernel is running following any required reboot.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43380 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-43380Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd014538aa38561cd24c5eb228223585f26c5ec71, d014538aa38561cd24c5eb228223585f26c5ec71, d014538aa38561cd24c5eb228223585f26c5ec71, d014538aa38561cd24c5eb228223585f26c5ec71, d014538aa38561cd24c5eb228223585f26c5ec71, d014538aa38561cd24c5eb228223585f26c5ec71, d014538aa38561cd24c5eb228223585f26c5ec71unaffected
LinuxLinux5.11, 0, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.