CVE-2026-74547

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

When userspace configures 'auto_update_interval' to 0 via sysfs, the

background kthread executes schedule_timeout_interruptible(0), which

returns immediately.

If 'num_temp_sensors' is concurrently or previously set to 0, the

msleep_interruptible() delay inside adt7470_read_temperatures() also

becomes 0. This combination forces the background thread into a tight,

unbounded busy-loop, hogging the CPU and flooding the I2C bus with a

continuous stream of transactions.

Fix this vulnerability by raising the lower limit of the clamp_val in

auto_update_interval_store() from 0 to 500 milliseconds. This guarantees

a reasonable minimum sleep window between sensor updates, protecting the

system from intentional or accidental I2C bus denial of service.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References