CVE-2026-74552: hwmon: (lm90) Only report alarms if driver is ready
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm90) Only report alarms if driver is ready
Userspace can read sysfs attributes before driver registration is complete, immediately after devmhwmondeviceregisterwithinfo() has been called. At that time, data->hwmondev is not yet initialized. This can trigger a NULL pointer access since lm90updatedevice() and with it lm90updatealarmslocked() will be called. This call schedules reportwork and lm90reportalarms(), which passes the still-NULL data->hwmondev to hwmonnotifyevent() and triggers a NULL pointer dereference.
Fix the problem by only scheduling the report and alert workers data->hwmondev is set.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the lm90 driver behavior to schedule only the report_work and lm90_report_alarms() after devm_hwmon_device_register_with_info() completes, ensuring lm90_update_alarms_locked() is invoked only when data->hwmon_dev is non-NULL to prevent hwmon_notify_event(NULL) dereference from sysfs reads before registration is complete.
Linux kernel (hwmon: lm90) Only report alarms if driver is ready immediately after devm_hwmon_device_register_with_info() = Apply the logic so alarm reporting is scheduled only after driver registration completes (i.e., after data->hwmon_dev is initialized).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74552?
The severity of CVE-2026-74552 is classified as risk 17.
How do I fix CVE-2026-74552?
To fix CVE-2026-74552, ensure that the driver is fully registered before allowing userspace to read sysfs attributes.
What systems are affected by CVE-2026-74552?
CVE-2026-74552 affects Linux kernel versions that use the lm90 hardware monitoring driver.
What are the consequences of CVE-2026-74552?
CVE-2026-74552 may allow userspace programs to read incomplete or inaccurate sensor data before proper driver readiness.
When was CVE-2026-74552 published?
CVE-2026-74552 was published on August 15, 2026.