The vulnerability in the Linux kernel's hwmon pmbus subsystem was due to unconditional casting of attributes to struct sensor_device_attribute in the pmbus_notify() function. Since data->group.attrs can contain different attribute types embedding a base device_attribute, this casting could cause slab-out-of-bounds reads or misinterpretation of fields, potentially leading to incorrect notification behavior. The fix changed struct pmbus_sensor and struct pmbus_label to embed struct sensor_device_attribute and set attr->index to -1 for attributes that never trigger notifications, preventing unsafe memory access and type confusion.

This vulnerability could cause out-of-bounds memory reads in kernel space or incorrect notification logic due to type confusion. However, no known exploits in the wild have been reported. The impact is primarily on kernel stability and correctness rather than direct remote code execution or privilege escalation, based on the available data.

A fix has been implemented in the Linux kernel to correct the type confusion issue by restructuring attribute types and using a sentinel index value. Users should apply the official kernel update that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.