CVE-2026-74549

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nct6775-core driver where the nct6116 chip initialization sets data->pwm num to 5, while the associated register arrays (including NCT6106 REG WEIGHT DUTY STEP, NCT6106 REG WEIGHT TEMP SEL, and NCT6106 REG WEIGHT TEMP *) only contain 3 elements. When the nct6775 update pwm() function iterates up to data->pwm num, it may attempt to read indices 3 and 4 if bits 3 or 4 of data->has pwm are set. This causes a global out-of-bounds read. The resulting invalid values are then used as hardware register addresses for read and write operations, which can lead to hardware misconfiguration or system crashes. This occurs because the chip supports five fan control channels, but only the first three support weight control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.