UBUNTU-CVE-2026-98200: Use After Free

In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungibleshow() nsensor->currentstate is dynamically replaced as the sensor's state changes. updatenumericsensorfromwobj() does this by freeing the old string and installing a new one: if (strcmp(trimmed, nsensor->currentstate)) { newstring = hpwmistrdup(dev, trimmed); if (newstring) { devmkfree(dev, nsensor->currentstate); nsensor->currentstate = newstring; } } This function is only ever called from hpwmiupdateinfo() while state->lock is held, so the free-and-replace itself is properly serialized against concurrent updates. fungibleshow(), however, reads the same pointer after the lock has already been dropped: err = hpwmiupdateinfo(state, info); if (err) return err; switch (prop) { ... case HPWMIPROPERTYCURRENTSTATE: seqprintf(seqf, "%s\n", nsensor->currentstate); break; hpwmiupdateinfo() takes state->lock internally and releases it before returning, so by the time fungibleshow() dereferences nsensor->currentstate in seqprintf(), no lock is held. Two processes reading a sensor's currentstate debugfs entry at overlapping times (or one reading it while another read of the same sensor triggers a refresh) can race: one thread's seqprintf() can be part-way through printing the string at the moment another thread's call into updatenumericsensorfromwobj() frees it with devmkfree() and installs a new pointer, causing a use-after-free read. Take state->lock around the read in fungibleshow() as well, so it can never run concurrently with the free-and-replace in updatenumericsensorfromwobj().