CVE-2026-74552: hwmon: (lm90) Only report alarms if driver is ready
hwmon: (lm90) Only report alarms if driver is ready
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Configuration
Modify the lm90 driver behavior to schedule only the report_work and lm90_report_alarms() after devm_hwmon_device_register_with_info() completes, ensuring lm90_update_alarms_locked() is invoked only when data->hwmon_dev is non-NULL to prevent hwmon_notify_event(NULL) dereference from sysfs reads before registration is complete.
Linux kernel (hwmon: lm90) Only report alarms if driver is ready immediately after devm_hwmon_device_register_with_info() = Apply the logic so alarm reporting is scheduled only after driver registration completes (i.e., after data->hwmon_dev is initialized).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74552?
The severity of CVE-2026-74552 is classified as risk 17.
How do I fix CVE-2026-74552?
To fix CVE-2026-74552, ensure that the driver is fully registered before allowing userspace to read sysfs attributes.
What systems are affected by CVE-2026-74552?
CVE-2026-74552 affects Linux kernel versions that use the lm90 hardware monitoring driver.
What are the consequences of CVE-2026-74552?
CVE-2026-74552 may allow userspace programs to read incomplete or inaccurate sensor data before proper driver readiness.
When was CVE-2026-74552 published?
CVE-2026-74552 was published on August 15, 2026.