CVE-2026-98200: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
hwmon: (hp-wmi-sensors) Fix use-after-free in fungibleshow()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel hwmon hp-wmi-sensors driver, hold state->lock around the nsensor->current_state read in fungible_show(), including the seq_printf() call, so it cannot race with update_numeric_sensor_from_wobj() freeing and replacing the string.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel hp-wmi-sensors hardware-monitoring driver are exposed when concurrent processes read the affected sensor state. The race occurs around the dynamically replaced current_state string.
What is required to trigger the use-after-free?
At least two concurrent sensor-state reads are needed: one read updates and replaces current_state, while another dereferences the old pointer after the driver lock has been released.
Is there a workaround if an updated kernel cannot be deployed immediately?
The provided information does not identify a configuration workaround. Reducing or avoiding concurrent reads of the affected hp-wmi-sensors current-state interface may reduce exposure, but this is not stated as a complete mitigation.