Executive brief
A vulnerability in the Linux kernel's IBM PowerExecutive (ibmpex) hardware monitoring driver could allow a local user to cause a system crash. The issue stems from a race condition during the removal of the driver, where the system might attempt to access sensor data that has already been cleared. This primarily impacts system availability and operational stability.
Technical details
A race condition exists in the ibmpex hardware monitoring driver (drivers/hwmon/ibmpex.c) due to improper ordering during device cleanup. A previous attempt to fix a use-after-free vulnerability introduced a new race condition by setting driver data to NULL via dev_set_drvdata() before removing the associated sysfs sensor attributes. If a userspace process attempts to read a sensor attribute (e.g., via ibmpex_show_sensor()) while the device is being deleted, the kernel may attempt to dereference a NULL pointer. This vulnerability was addressed by reverting the problematic patch and restoring the original cleanup order, ensuring device_remove_file() completes before driver data is cleared.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.7, 6.12, 6.13
Timeline
- 2026-02-07: patched: Initial fix commit authored by Guenter Roeck
- 2026-05-27: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a
- https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64
- https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d
- https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006
- https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1
- https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18
- https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5