Executive brief
A deadlock vulnerability exists in the Linux kernel's hwmon (hardware monitoring) OCC driver when unregistering sysfs devices. The driver holds a lock while waiting for active sysfs callbacks to complete, but those callbacks try to acquire the same lock, creating a circular wait condition that can freeze the system.
Technical details
This is a lock-ordering vulnerability (potential deadlock) in the hwmon OCC (On-Chip Controller) driver. The vulnerability occurs in occ_active(false) and occ_shutdown() which hold the occ->lock mutex while calling hwmon_device_unregister() and sysfs_remove_group(). These unregister functions wait for active sysfs callbacks to drain; however, those callbacks (e.g., occ_show_temp_1) can re-enter the OCC update path and attempt to re-acquire occ->lock, creating a circular lock dependency. A local user with sysfs access can trigger this by invoking callbacks while unregistration is in progress, causing a system deadlock. The fix involves separating hwmon registration/removal locking, releasing occ->lock before calling unregister functions, and making OCC update callbacks return -ENODEV after deactivation.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-28: disclosed