Executive brief
A vulnerability was identified in the Linux kernel's driver for the TMP006 temperature sensor. When the driver is unloaded, it fails to properly unregister certain internal components, which could lead to system instability or crashes. This affects systems using this specific hardware sensor, potentially impacting the reliability of industrial or embedded devices.
Technical details
A vulnerability exists in the tmp006 temperature sensor driver within the Industrial I/O (IIO) subsystem of the Linux kernel. The tmp006_probe() function allocates a DRDY trigger using devm_iio_trigger_alloc() but registers it using the non-managed iio_trigger_register() function. Because the driver lacks a .remove() callback to manually unregister the trigger, unloading the module leaves a dangling entry in the global trigger list while the underlying memory is freed by the devm subsystem. This results in a use-after-free scenario if the global trigger list is subsequently accessed. The issue has been resolved by switching to the managed devm_iio_trigger_register() function.
Affected products
- Linux Linux Kernel 6.13, 6.18.39, 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory