{"apiVersion":"1.0","identifier":"CVE-2026-74685","description":"In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Clamp negative current limits When a negative value is passed to ltc4282_write_curr(), the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282_write_curr() { /* need to pass it in millivolt */ u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st->rsense, DECA * MICRO); ... } This cast converts negative inputs into large positive values. The subsequent division result overflows the u32 in variable, truncating to a pseudo-random positive value. When this is passed to ltc4282_write_voltage_byte(), it is clamped to the maximum limit instead of zero. Clamp val to 0 and to the maximum supported upper limit before the cast and assign the result to a 64-bit temporary variable before the division to avoid the underflow and an also possible overflow.","publishedAt":"2026-08-22T16:16:42","lastModifiedAt":"2026-08-22T16:16:42","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74685","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00168,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74685","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74685","en":"https://www.redsauce.net/en/cves/CVE-2026-74685","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74685","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74685","de":"https://www.redsauce.net/de/cves/CVE-2026-74685","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74685","el":"https://www.redsauce.net/el/cves/CVE-2026-74685"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74685"}}