CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device
hwmon: (lm90) Stop work before releasing hwmon device
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the Linux kernel lm90 driver, add a shutdown flag to prevent lm90_alert_work() and lm90_report_alarms() from being re-armed during shutdown, and separately cancel alert_work and report_work after interrupts are disabled and before the hwmon device is released.
Event History
Frequently Asked Questions
When can this race be triggered?
It can occur during module unbind or probe failure, if lm90 alert or alarm-reporting delayed work runs after the hwmon device has been unregistered and freed but before that work is cancelled.
What access or conditions are required for exploitation?
The CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction. The affected system must be using the lm90 hwmon driver and encounter the relevant device teardown or probe-failure timing window.
What is the impact if the race occurs?
The worker can dereference the freed data->hwmon_dev pointer in lm90_update_alarms(). The CVSS assessment indicates availability impact only, with no confidentiality or integrity impact.
What mitigation is available if the fixed kernel cannot be deployed immediately?
The provided information identifies the exposure during lm90 driver unbind or probe failure. Avoiding lm90 device teardown or driver unbinding reduces exposure to the described race window, but no complete temporary mitigation is specified.