CVE-2026-98000: hwmon: Fix potential UAF in pec_store

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

hwmon: Fix potential UAF in pecstore

Sashiko reports:

In pecstore(), a guard(mutex)(&hwdev->lock) is taken. If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls putdevice(hdev). If this drops the final reference, the device is freed. When the function then returns, the guard cleanup function runs and attempts to unlock the freed mutex.

Use scopedguard() instead of guard() to avoid the problem.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    In pec_store(), replace guard(mutex)(&hwdev->lock) with scoped_guard() to ensure the mutex is not unlocked after the device has been freed.

Event History

Sep 25, 2026
CVE Published
via MITRE·10:23 AM
Data Sourced
via MITRE·10:23 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What condition is required to trigger the use-after-free path?

The chip write operation in pec_store() must return an error other than -EOPNOTSUPP. The subsequent put_device(hdev) can free the device if it drops the final reference, after which the mutex cleanup attempts to unlock freed memory.

2

Which systems are exposed?

Systems running a Linux kernel containing the affected hwmon pec_store() implementation are exposed when the described error path can occur. The provided information does not identify affected kernel versions, hardware models, or configurations.

3

What code change resolves the issue?

The fix replaces guard(mutex)(&hwdev->lock) with scoped_guard() in pec_store(). This ensures the mutex is released before put_device(hdev) can free the device.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203