CVE-2026-31486

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) Protect regulator operations with mutex

The regulator operations pmbus_regulator_get_voltage(),

pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage()

access PMBus registers and shared data but were not protected by

the update_lock mutex. This could lead to race conditions.

However, adding mutex protection directly to these functions causes

a deadlock because pmbus_regulator_notify() (which calls

regulator_notifier_call_chain()) is often called with the mutex

already held (e.g., from pmbus_fault_handler()). If a regulator

callback then calls one of the now-protected voltage functions,

it will attempt to acquire the same mutex.

Rework pmbus_regulator_notify() to utilize a worker function to

send notifications outside of the mutex protection. Events are

stored as atomics in a per-page bitmask and processed by the worker.

Initialize the worker and its associated data during regulator

re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References