CVE-2026-74685

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ltc4282) Clamp negative current limits

When a negative value is passed to ltc4282_write_curr(), the signed long

val is cast directly to u64:

drivers/hwmon/ltc4282.c:ltc4282_write_curr() {

/* need to pass it in millivolt */

u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO);

...

}

This cast converts negative inputs into large positive values. The

subsequent division result overflows the u32 in variable, truncating

to a pseudo-random positive value. When this is passed to

ltc4282_write_voltage_byte(), it is clamped to the maximum limit instead

of zero.

Clamp val to 0 and to the maximum supported upper limit before the cast

and assign the result to a 64-bit temporary variable before the division

to avoid the underflow and an also possible overflow.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References