CVE-2026-98198: hwmon: (pwm-fan) Stop RPM timer before freeing tach data
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.8-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the hwmon pwm-fan driver, split timer retirement from power cleanup, register the timer-stopping devres action after the timer backing data and IRQ actions are installed, and use timer_shutdown_sync() so the self-rearming RPM timer is retired before ctx->tachs and ctx->pulses_per_revolution are released.
Event History
Frequently Asked Questions
When can this flaw be triggered?
The affected window occurs when the pwm-fan driver is detached or unbound. An RPM timer can expire after its devm-managed tachometer data has been freed but before the driver cleanup stops the timer.
What systems are exposed?
Systems using the Linux kernel pwm-fan driver with RPM/tachometer monitoring are relevant. The provided information does not identify specific kernel versions or indicate whether a particular hardware configuration is required beyond use of this driver functionality.
What is the observed impact?
The timer callback can read from and write to freed tach data, creating a use-after-free condition. Testing with KASAN observed multiple four-byte reads and writes after the backing allocations were released.
How can administrators tell whether the fix is effective?
The described validation used repeated normal sysfs unbind operations while delaying cleanup entry. With the fix, these runs completed without KASAN reports, BUGs, warnings, Oops messages, or panics, and instrumentation showed timer retirement completed before timer backing data was freed.