Bug 2517038 (CVE-2026-74547)

Summary: CVE-2026-74547 kernel: hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's hwmon (adt7470) component. A local user can exploit this by configuring the 'auto_update_interval' to zero via sysfs while 'num_temp_sensors' is also set to zero. This combination forces the background thread into an unbounded busy-loop, consuming CPU resources and flooding the I2C bus with continuous transactions. This can lead to a denial of service (DoS) of the I2C bus.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:46:13 UTC 
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

When userspace configures 'auto_update_interval' to 0 via sysfs, the
background kthread executes schedule_timeout_interruptible(0), which
returns immediately.

If 'num_temp_sensors' is concurrently or previously set to 0, the
msleep_interruptible() delay inside adt7470_read_temperatures() also
becomes 0. This combination forces the background thread into a tight,
unbounded busy-loop, hogging the CPU and flooding the I2C bus with a
continuous stream of transactions.

Fix this vulnerability by raising the lower limit of the clamp_val in
auto_update_interval_store() from 0 to 500 milliseconds. This guarantees
a reasonable minimum sleep window between sensor updates, protecting the
system from intentional or accidental I2C bus denial of service.
Comment 1 Mauro Matteo Cascella 2026-08-19 19:01:50 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081549-CVE-2026-74547-6a6e@gregkh/T