CVE-2026-98199

Executive Summary

CVE-2026-98199 is a Linux kernel vulnerability in the hwmon PMBus core (hwmon: (pmbus/core)) concerning an insufficient number of supported power-supply "phases." The patch increases the phase count to 16 and adds a new mask for controlling the source of the output voltage, but reviewer analysis (credited to groeck, citing Sashiko review) determined that the existing mp2975 (up to 14 phases) and mp2856 (up to 12 phases) drivers already exceed the previous limit, creating a potential out-of-bounds write when probing affected chips. Impact is a memory-corruption condition in kernel space reachable during device probing, which can lead to denial of service and, in the worst case, privilege escalation or code execution in kernel context. Organizations running kernels built with the mp2975 or mp2856 PMBus/hwmon drivers on systems exposing such voltage regulators (servers, BMC-managed platforms, embedded/telecom hardware) are in scope.

Technical Analysis

The PMBus hwmon core maintains a per-device notion of how many output "phases" a regulator reports, and the array or field that stores phase information was sized to an older maximum. The patch raises that maximum to 16 to accommodate an upcoming device and adds a mask used to select the source of the output voltage.

The critical fact from the description is not the new device support but the existing mismatch: per the note, the mp2975 driver already supports up to 14 phases and the mp2856 driver up to 12 phases, while the core-side limit was lower. This means that when these drivers probe a chip reporting more phases than the core array can hold, a write can occur beyond the bounds of the phase storage structure — a classic CWE-787 (out-of-bounds write) condition, aggravated by improper validation of a device-supplied index (CWE-129).

Attack-surface characteristics:

• Trigger point: device probing — i.e., when the affected PMBus drivers bind to a compatible multiphase voltage regulator. The number of phases is advertised by the hardware/device, so the value is influenced by the physical device being probed (and potentially by a hostile or emulated device).
• Locality: PMBus is a local hardware-management bus (I²C/SMBus-class topology). The bug is therefore not directly network-reachable; it is a local/physical or firmware-firmware-adjacent memory-safety issue.
• Reclassification significance: although the patch was authored as feature preparation, community review judged it to be a bug fix because the bug is already present at the old limit. This is the key analytic point: the vulnerability is latent in existing code paths, not introduced by the new device.

Insufficient technical detail is available in the provided data to name the exact field, structure, or function performing the out-of-bounds write; the description references mp2975 and mp2856 drivers and the pmbus/core subsystem only. No specific symbol names beyond those should be assumed.

Exploitation Scenarios

No public PoC is available; the following chain is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. An attacker (or a hostile hardware component) identifies a host running a Linux kernel built with the in-tree mp2975 or mp2856 PMBus driver and a physically attached or emulated compatible multiphase voltage regulator. Because the flaw manifests on probe, the relevant precondition is that such a device is present at boot or hot-attach.

2. Triggering the flaw. During probe of the affected chip, the core initializes phase tracking using the phase count reported by the device. For mp2975 (up to 14 phases) and mp2856 (up to 12 phases), this count exceeds the pre-patch core limit, so the write to the phase storage exceeds its bounds — an out-of-bounds write. The exact byte offset and the overwritten target are not specified in the available data.

3. Execution method (class-level). This is a memory-corruption primitive in kernel space. Realistic vectors are: (a) a malicious or counterfeit hardware regulator presenting an inflated phase count, and (b) a privileged or fault-injected device-emulation path (e.g., virtualized/emulated I²C or firmware-on-Linux test harness). No code-execution or heap-spray technique is asserted here because none is described in the data.

4. Post-exploitation impact. Corrupting kernel memory adjacent to the phase array can yield a kernel crash/oops (denial of service), and, depending on what is overwritten and attacker control over the offending value, potential kernel-context code execution or privilege escalation. Because the trigger is local/probe-time, remote-only preconditions are not established by the data.

Impact Assessment

• Confidentiality: Potentially High in a worst-case memory-corruption scenario, but only with a viable local/emulation precondition; not demonstrated in the data.
• Integrity: High in principle — an out-of-bounds write to kernel memory can corrupt critical data structures.
• Availability: Most immediately demonstrable outcome is a kernel fault/panic during probing (DoS), which is realistic and low-complexity once the trigger device condition is met.
• Scope: Kernel-wide, but precondition-limited by the need for affected PMBus hardware/drivers to be present and probed.
• Blast radius: Data-center and edge servers, BMC/hardware-management platforms, telecom/embedded systems, and any deployment whose kernel includes the mp2975/mp2856 drivers and the corresponding regulator hardware. Cloud and virtualized environments are lower exposure unless PMBus device emulation is reachable to a guest or attacker.
• CVSS: NVD provides no score or vector; no subscores exist to cite. This report deliberately does not assign invented values.

Detection Guidance

Detection focuses on kernel probe faults associated with PMBus/mp2975/mp2856 activity and on unexpected out-of-bounds indications at load time.

Sigma Rule

title: Linux Kernel PMBus Probe Out-of-Bounds Write Indicator (CVE-2026-98199)
id: 6f2c9b1e-3a4d-4b77-9c2e-8d1a5f0e7b21
status: experimental
description: Detects kernel log indicators of out-of-bounds writes / memory corruption during PMBus (mp2975/mp2856) device probe, associated with CVE-2026-98199.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98199
author: valtersit.com threat intelligence
logsource:
  product: linux
  service: kernel
detection:
  selection_driver:
    - "mp2975"
    - "mp2856"
    - "pmbus"
  selection_fault:
    - "out of bounds"
    - "out-of-bounds"
    - "KASAN"
    - "slab-out-of-bounds"
    - "BUG: unable to handle kernel"
    - "general protection fault"
  selection_context:
    - "probe"
    - "hwmon"
  condition: (selection_driver and selection_fault) or (selection_fault and selection_context)
falsepositives:
  - Legitimate kernel fault injection / KASAN test campaigns
  - Unrelated KASAN reports in non-PMBus subsystems
level: high

YARA Rule

rule CVE_2026_98199_PMBus_Phase_OOB
{
    meta:
        description = "Heuristic detection of PMBus core phase-array handling related to CVE-2026-98199 (hwmon pmbus/core, mp2975/mp2856)"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98199"
        date = "2026-01-01"

    strings:
        $s1 = "pmbus" ascii nocase
        $s2 = "mp2975" ascii nocase
        $s3 = "mp2856" ascii nocase
        $s4 = "phases" ascii nocase
        $s5 = "hwmon" ascii nocase

    condition:
        uint32(0) == 0x464c457f and   // ELF magic: scan kernel modules
        filesize < 5MB and
        $s2 and $s3 and $s1 and $s5
}

Suricata IDS Rule

# CVE-2026-98199: PMBus/hwmon phase handling is a local hardware-bus memory-safety
# issue and produces no direct network signature. This rule alerts on SMBus/I2C-over-IP
# style PMBus traffic touching multiphase regulators (mp2975/mp2856 support modules),
# intended for environments tunneling local buses over the network.
alert tcp any any -> any 1234 (msg:"CVE-2026-98199 Possible PMBus Phase Handling Abuse (mp2975/mp2856)"; flow:to_server,established; content:"|09 02|"; depth:2; content:"|00|"; byte_test:1,=,0x00,0,relative; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026981990; rev:1; reference:cve,2026-98199; metadata:created_at 2026_01_01, confidence Low;)

Elastic Detection

process where host.os.type == "linux" and event.category == "process"
and event.action in ("exec", "start")
and process.name in ("insmod", "modprobe")
and process.args in ("mp2975", "mp2856", "pmbus_core")

Supplementary kernel-log EQL to surface the fault itself:

any where host.os.type == "linux"
and event.category == "driver" or event.dataset == "system.syslog"
and message matches~ ".*(out[- ]of[- ]bounds|KASAN|general protection fault).*"
and message matches~ ".*(mp2975|mp2856|pmbus|hwmon).*"

Splunk SPL Query

index=linux sourcetype=syslog ("mp2975" OR "mp2856" OR "pmbus" OR "hwmon")
("out of bounds" OR "out-of-bounds" OR "KASAN" OR "slab-out-of-bounds" OR "general protection fault" OR "unable to handle kernel")
| stats count min(_time) as first_seen max(_time) as last_seen values(_raw) as events by host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="linux,kernel,cve-2026-98199,">
  <rule id="2026981" level="12">
    <decoded_as>syslog</decoded_as>
    <match>mp2975|mp2856|pmbus|hwmon</match>
    <regex>out[- ]of[- ]bounds|KASAN|general protection fault|unable to handle kernel</regex>
    <description>CVE-2026-98199: possible out-of-bounds write during PMBus (mp2975/mp2856) probe</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>kernel_memory_corruption,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Where the mp2975/mp2856 drivers and corresponding multiphase regulators are not required, blacklist or avoid building/loading them (hwmon/mp2975/mp2856) so the vulnerable probe path is never reached.
   • Restrict access to local device-management paths (I²C/SMBus, firmware-update and hardware-management interfaces) to trusted privileged users only; do not expose device-emulation surfaces to untrusted guests or operators.
   • Monitor kernel logs for probe-time faults on the mentioned drivers (see Detection Guidance) and treat occurrences as possible exploitation/trigger.

2. Patch / upgrade steps

   • No vendor fix or backport is confirmed in the provided data. Track the Linux kernel hwmon/PMBus (pmbus-core) tree and your distribution's kernel stable updates for a commit implementing "increase number of phases to 16" and "new mask for controlling the source of the output voltage." Apply the upstream core fix plus backports for mp2975 and mp2856 once available.
   • Until then, treat any kernel carrying these drivers as unpatched for this issue.

3. Long-term hardening

   • Enable KASAN (or equivalent hardened builds) in test environments to catch probe-time out-of-bounds writes early.
   • Enforce kernel-module allowlisting consistent with actual hardware, reducing the reachable driver attack surface.
   • Maintain a hardware-inventory-to-driver mapping so that phase-count reporting mismatches and unsupported PMBus devices are flagged before deployment.

References

• NVD — CVE-2026-98199: https://nvd.nist.gov/vuln/detail/CVE-2026-98199
• Linux kernel hwmon/PMBus subsystem sources (upstream pmbus core; mp2975, mp2856 drivers) for the phase-count and output-voltage-source mask change
• CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• CWE-129 — Improper Validation of Array Index: https://cwe.mitre.org/data/definitions/129.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

No threat-actor campaign, exploit-in-the-wild evidence, CISA KEV listing, PoC, or Nuclei template is associated with CVE-2026-98199 in the supplied data.