Executive brief
A vulnerability was identified in the Linux kernel's LM90 hardware monitoring driver, which is used to track system temperatures and sensor data. Under specific conditions during system shutdown or driver removal, the software may attempt to access memory that has already been cleared. This can lead to a system crash or instability, potentially impacting the availability of the affected server or workstation.
Technical details
A use-after-free vulnerability exists in the Linux kernel lm90 hwmon driver (drivers/hwmon/lm90.c). The issue stems from an incorrect registration order of devm cleanup actions in lm90_probe(). Because devm executes cleanup actions in reverse order, the hwmon device is unregistered and freed before the alert_work and report_work delayed workers are cancelled. If these workers execute in the window between the device being freed and the works being cancelled, lm90_update_alarms() dereferences the already-freed data->hwmon_dev pointer. The fix involves explicitly canceling workers before the hwmon device is released and introducing a shutdown flag to prevent re-arming. This is a local race condition requiring specific timing during module unbind or probe failure.
Affected products
- Linux Linux Kernel 6.0 to 6.18.34, 7.0.11
Timeline
- 2026-05-14: other: Patch authored
- 2026-07-19: disclosed: CVE published