Skip to main content

Linux Kernel CVE-2026-64213

| EUVDEUVD-2026-48621 MEDIUM
2026-07-24 Linux GHSA-mf77-wwf7-m2ff
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires concurrent interrupt and sysfs write timing to be won, warranting AC:H over NVD's AC:L; AV:L and PR:L reflect required local access and low-privilege sysfs write capability.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 22:31 vuln.today
CVSS changed
Aug 11, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (lm90) Add lock protection to lm90_alert

Sashiko reports:

lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock.

Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it.

If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register.

This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm.

Add the missing lock to lm90_alert() to solve the problem.

AnalysisAI

Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.

Technical ContextAI

The lm90 driver manages LM90-family I2C/SMBus temperature sensors within the Linux kernel's hwmon subsystem. The driver maintains a software-cached copy of the sensor's configuration register in data->config, which multiple code paths - both the SMBus alert interrupt handler (lm90_alert) and sysfs write callbacks (e.g., lm90_write_convrate) - read-modify-write. The sysfs path correctly acquires hwmon_lock before modifying data->config and restores the original value on completion. However, lm90_alert(), which executes in the interrupt/SMBus-alert context, modifies data->config to clear the hardware alert enable bit without holding hwmon_lock. This unsynchronized concurrent access constitutes improper locking (analogous to CWE-667) - not a traditional data race in the C memory model sense, but a logical race where the sysfs restore sequence invalidates the interrupt handler's state change, leaving the hardware alert line re-armed against an active alarm condition. The affected code was introduced at commit 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f (Linux 5.3). All three kernel stable branches have upstream fix commits referenced in the kernel stable tree.

RemediationAI

Upgrade to Linux 6.18.34, 7.0.11, or 7.1, which include the locking fix for lm90_alert(). The upstream stable patches are at https://git.kernel.org/stable/c/bed1fc32e0eb653806fa98afcf55f9a311fc4ce2, https://git.kernel.org/stable/c/b0b66aae8a94c3663d47e4000b0e81b89ce32186, and https://git.kernel.org/stable/c/873e919e3101063a7a75989510ccfc125a4391cf. Ubuntu users should apply USN-8618-1 via standard package management. If immediate kernel upgrade is not feasible and the system does not critically depend on LM90 sensor monitoring, unloading the lm90 module (rmmod lm90) eliminates the vulnerable code path entirely - trade-off is loss of hardware thermal monitoring from affected sensors, which may affect thermal management on sensitive hardware. Restricting sysfs hwmon write permissions (chmod o-w /sys/class/hwmon/*/convrate or equivalent) reduces the attack surface for unprivileged users but does not prevent the race from privileged processes or kernel-internal callers. No patch version beyond what EUVD confirms (6.18.34, 7.0.11, 7.1) should be assumed without verification.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64213 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy