CVE-2026-89937: iio: chemical: sgp30: Handle IAQ thread creation failure
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: sgp30: Handle IAQ thread creation failure
kthreadrun() can fail and return an error pointer, but sgpprobe() stores it and returns success, so the device is registered without its IAQ thread and sgpremove() later passes the error pointer to kthreadstop(). Return the error from probe instead.
Affected Software
Event History
Frequently Asked Questions
Under what condition can this issue occur?
It occurs when kthread_run() fails during sgp_probe(). The driver stores the resulting error pointer, reports probe success, and registers the device without its IAQ thread.
What happens when the affected device is later removed?
The removal path passes the stored error pointer to kthread_stop(). This occurs after the earlier thread-creation failure was incorrectly treated as a successful probe.
How does the resolved behavior change failure handling?
The fix returns the thread-creation error from probe instead of registering the device. This prevents a device with no IAQ thread and an invalid stored thread pointer from being registered.