CVE-2026-80745

The fp9931 regulator driver in the Linux kernel maps VPOS/VNEG voltage selectors using an array (VPOSNEG_table[]) that does not match the FP9931 datasheet: it contains one duplicate 7.04V entry (shifting all subsequent mappings by one) and only 41 entries where the 0x00-0x3F selector range requires 64. If the hardware selector is programmed to a value above 0x28, the driver performs an out-of-bounds array access, which per the assigned CVSS carries high confidentiality, integrity and availability impact (potential kernel memory disclosure, memory corruption, or a crash). The incorrect low-end mapping also means affected boards could program the +/- display supply rails to slightly wrong voltages even at valid selectors. Only systems running Linux kernels built with the fp9931 regulator driver are affected, i.e. embedded boards that use the FP9931 PMIC. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Update affected systems to a kernel containing the corrected VPOSNEG_table[] (64 entries matching the datasheet) when it reaches your distribution; there is no workaround beyond disabling or avoiding the fp9931 driver on boards that do not use the PMIC. Check whether your kernel build includes the fp9931 regulator driver and whether your hardware actually uses the FP9931; given no known exploitation, patching at the next regular maintenance cycle is reasonable.