CVE-2026-98200: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

Published Oct 6, 2026

Updated

hwmon: (hp-wmi-sensors) Fix use-after-free in fungibleshow()

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:44 AM

Data Sourced

via MITRE·08:44 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Oct 7, 2026

Data Sourced

via Microsoft·08:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux kernel hp-wmi-sensors hardware-monitoring driver are exposed when concurrent processes read the affected sensor state. The race occurs around the dynamically replaced current_state string.

What is required to trigger the use-after-free?

At least two concurrent sensor-state reads are needed: one read updates and replaces current_state, while another dereferences the old pointer after the driver lock has been released.

Is there a workaround if an updated kernel cannot be deployed immediately?

The provided information does not identify a configuration workaround. Reducing or avoiding concurrent reads of the affected hp-wmi-sensors current-state interface may reduce exposure, but this is not stated as a complete mitigation.

CVE-2026-98200: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What is required to trigger the use-after-free?

Is there a workaround if an updated kernel cannot be deployed immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What is required to trigger the use-after-free?

Is there a workaround if an updated kernel cannot be deployed immediately?