CVE-2026-74547

hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 19, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

When userspace configures 'auto_update_interval' to 0 via sysfs, the background kthread executes schedule_timeout_interruptible(0), which returns immediately.

If 'num_temp_sensors' is concurrently or previously set to 0, the msleep_interruptible() delay inside adt7470_read_temperatures() also becomes 0. This combination forces the background thread into a tight, unbounded busy-loop, hogging the CPU and flooding the I2C bus with a continuous stream of transactions.

Fix this vulnerability by raising the lower limit of the clamp_val in auto_update_interval_store() from 0 to 500 milliseconds. This guarantees a reasonable minimum sleep window between sensor updates, protecting the system from intentional or accidental I2C bus denial of service.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	89fac11cb3e7c5860c425dba14845c09ccede39d to before 2c4c4d7cadd10b50b5489183bbbb9eb95f6f8344Affected 89fac11cb3e7c5860c425dba14845c09ccede39d to before 4dc1518f9cc57c6db99514cafeb02dd7117d5bdaAffected 89fac11cb3e7c5860c425dba14845c09ccede39d to before 1325975a2eab265510e6036d8bf0c0068373d332Affected 89fac11cb3e7c5860c425dba14845c09ccede39d to before 1a42bd72a66205e439db1d1142442b62d393408aAffected 89fac11cb3e7c5860c425dba14845c09ccede39d to before 38e6b5ce5794ff09442231cc171c2be5e900bab3Affected 89fac11cb3e7c5860c425dba14845c09ccede39d to before 82d65f7ef11edcea0228745440b8b4b1f222c34cAffected 89fac11cb3e7c5860c425dba14845c09ccede39d to before 5ea299c3aa42a827f6a863eeead6de3525bbb17aAffected 89fac11cb3e7c5860c425dba14845c09ccede39d to before cb0b7f9c43b0abbd422a7e4c2c85e91db429207cAffected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

89fac11cb3e7c5860c425dba14845c09ccede39d to before 2c4c4d7cadd10b50b5489183bbbb9eb95f6f8344Affected
89fac11cb3e7c5860c425dba14845c09ccede39d to before 4dc1518f9cc57c6db99514cafeb02dd7117d5bdaAffected
89fac11cb3e7c5860c425dba14845c09ccede39d to before 1325975a2eab265510e6036d8bf0c0068373d332Affected
89fac11cb3e7c5860c425dba14845c09ccede39d to before 1a42bd72a66205e439db1d1142442b62d393408aAffected
89fac11cb3e7c5860c425dba14845c09ccede39d to before 38e6b5ce5794ff09442231cc171c2be5e900bab3Affected
89fac11cb3e7c5860c425dba14845c09ccede39d to before 82d65f7ef11edcea0228745440b8b4b1f222c34cAffected
89fac11cb3e7c5860c425dba14845c09ccede39d to before 5ea299c3aa42a827f6a863eeead6de3525bbb17aAffected
89fac11cb3e7c5860c425dba14845c09ccede39d to before cb0b7f9c43b0abbd422a7e4c2c85e91db429207cAffected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.