---
id: "CVE-2026-99022"
kind: "vulnerability"
aliases: ["CVE-2026-99022"]
title: "Linux kernel: LTC3676 regulator driver lets a register dump reboot the board"
severity: "low"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["debugfs", "embedded", "linux-kernel", "runtime"]
not_affected_if: ["debugfs-not-exposed", "no-ltc3676-hardware"]
published_at: "2026-10-23T13:17:25+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99022", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99022", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: LTC3676 regulator driver lets a register dump reboot the board

The Linux kernel's ltc3676 regulator driver allowed reads of the write-only HRST and CLIRQ registers, and reading them fires the chip command. A plain debugfs register dump therefore hard-resets the board, causing a denial of service rather than code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel includes the ltc3676 regulator driver: `grep -i ltc3676 /boot/config-$(uname -r)`
- Check whether debugfs is mounted and the regmap file exists: `ls /sys/kernel/debug/regmap/`
- Check the running kernel version: `uname -r`

## Fix

- Update to a Linux kernel release that includes the upstream commit 'regulator: ltc3676: don't read the write-only HRST and CLIRQ registers' (fixed version unknown from the sources)

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99022
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99022

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST
triggers a hard reset of the chip and writing CLIRQ clears the interrupt;
reading them returns nothing useful, and the read itself fires the command.

The result is that a plain register dump resets the board:

  cat /sys/kernel/debug/regmap/2-003c/registers

walks every readable register, hits HRST, and the board reboots.

Split the callback back in two so HRST and CLIRQ stay writable but are no
longer readable. The readable range is left unchanged
(LTC3676_BUCK1 ... LTC3676_IRQSTAT).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_