{"id":"CVE-2026-99022","kind":"vulnerability","aliases":["CVE-2026-99022"],"related":[],"title":"Linux kernel: LTC3676 regulator driver lets a register dump reboot the board","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: ltc3676: don't read the write-only HRST and CLIRQ registers\n\nHRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST\ntriggers a hard reset of the chip and writing CLIRQ clears the interrupt;\nreading them returns nothing useful, and the read itself fires the command.\n\nThe result is that a plain register dump resets the board:\n\n  cat /sys/kernel/debug/regmap/2-003c/registers\n\nwalks every readable register, hits HRST, and the board reboots.\n\nSplit the callback back in two so HRST and CLIRQ stay writable but are no\nlonger readable. The readable range is left unchanged\n(LTC3676_BUCK1 ... LTC3676_IRQSTAT).","summary":"The Linux kernel's ltc3676 regulator driver allowed reads of the write-only HRST and CLIRQ registers, and reading them fires the chip command. A plain debugfs register dump therefore hard-resets the board, causing a denial of service rather than code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["debugfs","embedded","linux-kernel","runtime"],"not_affected_if":["debugfs-not-exposed","no-ltc3676-hardware"],"how_to_check":"- Check whether the kernel includes the ltc3676 regulator driver: `grep -i ltc3676 /boot/config-$(uname -r)`\n- Check whether debugfs is mounted and the regmap file exists: `ls /sys/kernel/debug/regmap/`\n- Check the running kernel version: `uname -r`","fix":"- Update to a Linux kernel release that includes the upstream commit 'regulator: ltc3676: don't read the write-only HRST and CLIRQ registers' (fixed version unknown from the sources)","status":"open","published_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:36+00:00","updated_at":"2026-10-25T04:55:36+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:55:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'regulator: ltc3676: don't read the write-only HRST and CLIRQ registers' (fixed version unknown from the sources)","reach":"local","title":"Linux kernel: LTC3676 regulator driver lets a register dump reboot the board","impact":"low","summary":"The Linux kernel's ltc3676 regulator driver allowed reads of the write-only HRST and CLIRQ registers, and reading them fires the chip command. A plain debugfs register dump therefore hard-resets the board, causing a denial of service rather than code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","debugfs"],"confidence":0.6,"needs_auth":"yes","worst_case":"A local user reading debugfs reboots the board, causing denial of service.","analyst_note":"","how_to_check":"- Check whether the kernel includes the ltc3676 regulator driver: `grep -i ltc3676 /boot/config-$(uname -r)`\n- Check whether debugfs is mounted and the regmap file exists: `ls /sys/kernel/debug/regmap/`\n- Check the running kernel version: `uname -r`","needs_analyst":false,"not_affected_if":["no-ltc3676-hardware","debugfs-not-exposed"],"who_is_affected":"Only systems that run a Linux kernel with the ltc3676 regulator driver bound to a board, typically embedded hardware that uses this Analog Devices/Linear Technology power management chip. Servers and desktops without this chip are unlikely to have the driver active. Anyone who can read debugfs on such a board can trigger the reset, so restricting debugfs access also limits exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":3490,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99022':15A,18A '/sys/kernel/debug/regmap/2-003c/registers':143C '0x1e':94C '0x1f':97C 'allow':32B 'back':157C 'board':12A,60B,141C,152C 'buck1':178C 'callback':156C 'cat':142C 'caus':61B 'chip':48B,112C 'clear':116C 'clirq':41B,91C,96C,115C,163C 'code':68B 'command':49B,102C,130C 'cve':13A,16A 'debugf':19B,52B 'denial':63B 'driver':5A,31B 'dump':9A,54B,138C 'embed':20B 'everi':145C 'execut':69B 'fire':46B,128C 'follow':75C 'hard':57B,108C 'hard-reset':56B 'hit':148C 'hrst':39B,89C,93C,105C,149C,161C 'interrupt':118C 'irqstat':180C 'kernel':2A,23B,27B,73C 'left':175C 'let':6A 'linux':1A,22B,26B,72C 'linux-kernel':21B 'longer':169C 'ltc3676':3A,29B,81C,177C,179C 'noth':122C 'plain':51B,136C 'rang':173C 'rather':66B 'read':33B,44B,84C,119C,126C 'readabl':146C,170C,172C 'reboot':10A,153C 'regist':8A,42B,53B,92C,137C,147C 'regul':4A,30B,80C 'reset':58B,109C,139C 'resolv':79C 'result':132C 'return':121C 'runtim':24B 'servic':65B 'split':154C 'stay':164C 'strobe':103C 'therefor':55B 'trigger':106C 'two':159C 'unchang':176C 'use':123C 'vulner':76C 'walk':144C 'writabl':165C 'write':37B,87C,100C,104C,114C 'write-on':36B,86C,99C","nicknames":[],"mitigations":[],"who_affected":"Only systems that run a Linux kernel with the ltc3676 regulator driver bound to a board, typically embedded hardware that uses this Analog Devices/Linear Technology power management chip. Servers and desktops without this chip are unlikely to have the driver active. Anyone who can read debugfs on such a board can trigger the reset, so restricting debugfs access also limits exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99022","severity":null,"published_at":"2026-10-23T13:17:25+00:00","modified_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}