LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46073: hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt

In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt wait_for_completion_interruptible_timeout() returns -ERESTARTSYS when interrupted. This needs to abort the URB and return an error. No data has been received from the device so any reads from the transfer buffer are invalid. The original code tests !ret, which only catches the timeout case (0). On signal delivery (-ERESTARTSYS), !ret is false so the function skips usb_kill_urb() and falls through to read from the unfilled transfer buffer. Fix by capturing the return value into a long (matching the function return type) and handling signal (negative) and timeout (zero) cases with separate checks that both call usb_kill_urb() before returning.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46073 is a Linux kernel bug in the powerz hardware-monitoring USB driver. If an interrupt signal occurs during a device read, the driver may continue using an unfilled transfer buffer instead of aborting the USB request. Business urgency depends on whether affected kernels and this driver are present.

Executive priority

Track and remediate through normal kernel patch governance unless asset review shows sensitive systems using this driver. There is no supplied evidence of active exploitation or a scored severity, but kernel memory-safety-adjacent driver flaws should not be ignored.

Technical view

The vulnerable path mishandles wait_for_completion_interruptible_timeout(). It checked only the timeout case, missing negative -ERESTARTSYS returns. On signal interruption, usb_kill_urb() was not called and code could read invalid data from the transfer buffer. Stable kernel commits correct this by handling negative and zero return cases separately.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the hwmon powerz USB driver in use. The bundle lists affected Linux versions and stable commit references, but provides no CVSS score, CWE, distribution mapping, or asset prevalence data.

Exploitation context

The source bundle does not show active exploitation, public exploitation, or CISA KEV listing. It describes a local kernel driver error condition involving signal interruption during USB transfer completion. Practical impact is not fully characterized in the supplied sources.

Researcher notes

The evidence supports root cause and fix direction, but not impact severity. Validate against downstream distribution patches because kernel vendors often backport fixes without matching upstream version strings. Avoid assuming exploitability beyond the described invalid transfer-buffer read.

Mitigation direction

  • Identify systems running affected Linux kernels and the powerz hwmon driver.
  • Apply vendor kernel updates containing the referenced stable fixes.
  • If updates are unavailable, check distribution guidance for backports or mitigations.
  • Prioritize systems where untrusted users can interact with affected hardware paths.

Validation and detection

  • Confirm kernel package version against vendor advisories and stable fix backports.
  • Check whether the powerz hwmon driver is built, loaded, or used.
  • Review change logs for inclusion of the referenced stable commits.
  • Record compensating controls if patched kernels are not yet available.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46073 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4381a36abdf1c5c0323c1c51f869dc000115eb20, 4381a36abdf1c5c0323c1c51f869dc000115eb20, 4381a36abdf1c5c0323c1c51f869dc000115eb20, 4381a36abdf1c5c0323c1c51f869dc000115eb20unaffected
LinuxLinux6.7, 0, 6.12.86, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.