CVE-2026-64038 (GCVE-0-2026-64038)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-07-19 15:39
VLAI
Title
hwmon: (lm90) Stop work before releasing hwmon device
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before devm_hwmon_device_register_with_info() is called. Because devm executes cleanup actions in reverse order during module unbind or probe failure, the hwmon device is unregistered and freed first. If lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here. Fix the problem by canceling the workers separately after registering the hwmon device and before registering the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released. Add "shutdown" flag to indicate that device shutdown is in progress to prevent workers from being re-armed.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < c98107817b0f6cdf51adc5e84e75c39ee25d8b28 (git)
Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < 479e297526aeb19c745eac5c1897f455f83dc5f8 (git)
Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < b09a45601094c7f4ec4db8090b825fa61e169d93 (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/lm90.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c98107817b0f6cdf51adc5e84e75c39ee25d8b28",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "479e297526aeb19c745eac5c1897f455f83dc5f8",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "b09a45601094c7f4ec4db8090b825fa61e169d93",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/lm90.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Stop work before releasing hwmon device\n\nSashiko reports:\n\nIn lm90_probe(), the devm action to cancel the alert_work and report_work\n(lm90_restore_conf) is registered in lm90_init_client() before\ndevm_hwmon_device_register_with_info() is called.\n\nBecause devm executes cleanup actions in reverse order during module\nunbind or probe failure, the hwmon device is unregistered and freed first.\n\nIf lm90_alert_work() or lm90_report_alarms() runs in the window between\nthe hwmon device being freed and the delayed works being cancelled,\nlm90_update_alarms() will dereference the freed data-\u003ehwmon_dev here.\n\nFix the problem by canceling the workers separately after registering\nthe hwmon device and before registering the interrupt handler. This ensures\nthat the workers are canceled after interrupts are disabled and before\nthe hwmon device is released. Add \"shutdown\" flag to indicate that device\nshutdown is in progress to prevent workers from being re-armed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:39:26.071Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c98107817b0f6cdf51adc5e84e75c39ee25d8b28"
        },
        {
          "url": "https://git.kernel.org/stable/c/479e297526aeb19c745eac5c1897f455f83dc5f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b09a45601094c7f4ec4db8090b825fa61e169d93"
        }
      ],
      "title": "hwmon: (lm90) Stop work before releasing hwmon device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64038",
    "datePublished": "2026-07-19T15:39:26.071Z",
    "dateReserved": "2026-07-19T07:54:57.028Z",
    "dateUpdated": "2026-07-19T15:39:26.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64038",
      "date": "2026-07-21",
      "epss": "0.00166",
      "percentile": "0.06192"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-21T01:01:22.000Z",
      "cve": "CVE-2026-64038",
      "id": "msrc_CVE-2026-64038",
      "initial_release_date": "2026-07-21T01:01:22.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hwmon: (lm90) Stop work before releasing hwmon device",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64038.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64038\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:44.053\",\"lastModified\":\"2026-07-19T16:17:44.053\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (lm90) Stop work before releasing hwmon device\\n\\nSashiko reports:\\n\\nIn lm90_probe(), the devm action to cancel the alert_work and report_work\\n(lm90_restore_conf) is registered in lm90_init_client() before\\ndevm_hwmon_device_register_with_info() is called.\\n\\nBecause devm executes cleanup actions in reverse order during module\\nunbind or probe failure, the hwmon device is unregistered and freed first.\\n\\nIf lm90_alert_work() or lm90_report_alarms() runs in the window between\\nthe hwmon device being freed and the delayed works being cancelled,\\nlm90_update_alarms() will dereference the freed data-\u003ehwmon_dev here.\\n\\nFix the problem by canceling the workers separately after registering\\nthe hwmon device and before registering the interrupt handler. This ensures\\nthat the workers are canceled after interrupts are disabled and before\\nthe hwmon device is released. Add \\\"shutdown\\\" flag to indicate that device\\nshutdown is in progress to prevent workers from being re-armed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/lm90.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f6d0775119fb905fb02eafa98d575cf8ee792d46\",\"lessThan\":\"c98107817b0f6cdf51adc5e84e75c39ee25d8b28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6d0775119fb905fb02eafa98d575cf8ee792d46\",\"lessThan\":\"479e297526aeb19c745eac5c1897f455f83dc5f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6d0775119fb905fb02eafa98d575cf8ee792d46\",\"lessThan\":\"b09a45601094c7f4ec4db8090b825fa61e169d93\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/lm90.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/479e297526aeb19c745eac5c1897f455f83dc5f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b09a45601094c7f4ec4db8090b825fa61e169d93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c98107817b0f6cdf51adc5e84e75c39ee25d8b28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T11:13:18+00:00",
      "cve": "CVE-2026-64038",
      "id": "CVE-2026-64038",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hwmon: (lm90) Stop work before releasing hwmon device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64038.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.