Executive brief
The Linux kernel's SGP30 chemical sensor driver failed to properly handle errors when creating an internal monitoring thread. If thread creation failed, the driver would still report success and allow the device to be registered, leading to crashes during device removal when the kernel tried to stop a non-existent thread.
Technical details
The vulnerability is a missing error-handling path in the sgp30 driver's probe function. The kthread_run() call can fail and return an error pointer, but the sgp_probe() function did not check for this condition before storing the return value and returning success. This caused sgp_remove() to later pass an error pointer to kthread_stop(), resulting in undefined behavior. The fix adds an IS_ERR() check after kthread_run() and returns the error code immediately via dev_err_probe() if thread creation fails. This affects the Linux kernel's Industrial I/O (IIO) chemical sensor subsystem driver for Sensirion SGP30/SGPC3 sensors.
Affected products
- Linux Linux kernel 5.x through 7.x and earlier
Timeline
- 2026-09-16: disclosed
- 2026-07-22: patched