CVE-2026-98000: hwmon: Fix potential UAF in pec_store
In the Linux kernel, the following vulnerability has been resolved:
hwmon: Fix potential UAF in pecstore
Sashiko reports:
In pecstore(), a guard(mutex)(&hwdev->lock) is taken. If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls putdevice(hdev). If this drops the final reference, the device is freed. When the function then returns, the guard cleanup function runs and attempts to unlock the freed mutex.
Use scopedguard() instead of guard() to avoid the problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In pec_store(), replace guard(mutex)(&hwdev->lock) with scoped_guard() to ensure the mutex is not unlocked after the device has been freed.
Event History
Frequently Asked Questions
What condition is required to trigger the use-after-free path?
The chip write operation in pec_store() must return an error other than -EOPNOTSUPP. The subsequent put_device(hdev) can free the device if it drops the final reference, after which the mutex cleanup attempts to unlock freed memory.
Which systems are exposed?
Systems running a Linux kernel containing the affected hwmon pec_store() implementation are exposed when the described error path can occur. The provided information does not identify affected kernel versions, hardware models, or configurations.
What code change resolves the issue?
The fix replaces guard(mutex)(&hwdev->lock) with scoped_guard() in pec_store(). This ensures the mutex is released before put_device(hdev) can free the device.