EUVD-2026-45611
GHSA-35qx-2fp8-64h3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to target host
-
ExploitTrigger lm90 driver unbind or probe failure
-
ExecutionWorker runs after hwmon device freed
-
ImpactDereference freed hwmon_dev, crash kernel
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a system whose hardware includes an LM90-family temperature sensor so the lm90 hwmon driver is actually probed and loaded; (2) local access with the privilege to initiate driver unbind/module removal via sysfs or to induce a probe failure - in practice root/CAP_SYS_ADMIN, which is stronger than the stated PR:L; and (3) winning a narrow timing race (AC:H) where lm90_alert_work() or lm90_report_alarms() executes in the window between the hwmon device being freed and the delayed works being cancelled. Limiting factors: availability-only impact (kernel oops/DoS, no code execution or data leak), dependence on specific sensor hardware, and the inherently unreliable race window. |
| Impact | All signals point to a genuinely low real-world priority despite the valid CWE-362 finding. The CVSS 3.1 base score is 4.7 (medium) and the vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a locally-triggered, high-complexity race with availability-only impact (a kernel use-after-free crash) - no confidentiality or integrity loss. EPSS reinforces this with a 0.17% exploitation probability (6th percentile), there is no CISA KEV listing, and no public exploit code is referenced. Exploitation status is therefore 'no public exploit identified at time of analysis'. The signals are internally consistent except for the metadata: the input 'Information Disclosure' tag directly contradicts the CVSS C:N rating - this is a use-after-free that causes a crash (A:H), not disclosure, so the tag appears mislabeled. One caveat on privileges: the CVSS vector states PR:L, but the realistic trigger (driver unbind via sysfs, or probe failure during module (un)bind) typically requires root/CAP_SYS_ADMIN, so the honest privilege barrier may be higher than PR:L implies - verify against your threat model. Net: a legitimate reliability fix, not an urgent security emergency. |
| Exploit ScenarioDerived | A local user with the ability to bind/unbind the lm90 hwmon driver (e.g. via sysfs, normally root) repeatedly triggers module unbind or forces probe failure while the device's delayed alert_work/report_work is scheduled. If a worker runs in the narrow window after the hwmon device is freed but before the works are cancelled, lm90_update_alarms() dereferences the freed data->hwmon_dev, causing a use-after-free and kernel crash (denial of service). No public exploit is known and the race window is narrow (AC:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
The Linux kernel's lm90 hardware-monitoring driver can be driven into a use-after-free race during driver unbind or a failed probe, where the delayed alert_work or report_work item executes after devm cleanup has already unregistered and freed the hwmon device, producing a kernel oops with availability-only impact. Systems are affected only if they contain an LM90-family temperature sensor so the lm90 driver is actually probed and loaded, and triggering the bug requires local privileged access (root or CAP_SYS_ADMIN, in practice stronger than the stated PR:L) plus a narrow timing window, which is why the issue rates only CVSS 4.7 with an EPSS of 0.17% (6th percentile). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released patches are available in the stable kernel branches (6.18.34, 7.0.11, 7.1).
RemediationAI
Apply the vendor-released patch: upgrade to Linux 6.18.34, 7.0.11 or 7.1 (or later), which contain the upstream fix commits (https://git.kernel.org/stable/c/c98107817b0f6cdf51adc5e84e75c39ee25d8b28, https://git.kernel.org/stable/c/479e297526aeb19c745eac5c1897f455f83dc5f8, https://git.kernel.org/stable/c/b09a45601094c7f4ec4db8090b825fa61e169d93), or install the distribution backport - Ubuntu users should apply USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). Because exploitation depends on reaching the driver unbind/probe-failure teardown path, a practical compensating control is to restrict the ability to unbind the lm90 driver or unload the module: limit write access to /sys/bus/*/drivers/lm90/unbind and to module removal (init_module/delete_module, CAP_SYS_ADMIN) to fully trusted administrators, accepting that this only narrows the attack surface and does not eliminate the race if a legitimate unbind or probe failure occurs. Blacklisting or not loading the lm90 module removes the vulnerable code path entirely but sacrifices temperature monitoring and thermal alerting on that hardware, so it should be reserved for systems that do not rely on LM90-family sensors. There is no configuration switch that safely disables only the racing work items, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-362 race condition with a use-after-free consequence, rooted in the ordering of device-managed (devm) resource cleanup inside the Linux hwmon subsystem. In lm90_probe(), the devm teardown action lm90_restore_conf - which is responsible for cancelling the delayed works alert_work and report_work - is registered from lm90_init_client() before devm_hwmon_device_register_with_info() registers the hwmon device. Because devm releases resources in reverse registration order, on module unbind or probe failure the hwmon device is unregistered and freed first, and only afterwards are the delayed works cancelled. If lm90_alert_work() or lm90_report_alarms() fires in that window, lm90_update_alarms() dereferences the freed data->hwmon_dev pointer, causing a use-after-free in kernel context. The upstream fix cancels the workers explicitly after the hwmon device is registered and before the interrupt handler is installed, guaranteeing that workers are stopped while interrupts are disabled and before the hwmon device is released, and adds a 'shutdown' flag so workers cannot be re-armed while device shutdown is in progress. The affected component is tracked under the generic CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, and the impact class is an availability-only kernel crash/oops - there is no memory-corruption-driven code execution or data exposure implied by the assessed vector (C:N/I:N/A:H).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only trigger (AV:L) winning a narrow teardown race (AC:H); PR:L retained though sysfs unbind usually needs root; impact is a kernel crash only, so C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm90) Stop work before releasing hwmon device
Sashiko reports:
In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before devm_hwmon_device_register_with_info() is called.
Because devm executes cleanup actions in reverse order during module unbind or probe failure, the hwmon device is unregistered and freed first.
If lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here.
Fix the problem by canceling the workers separately after registering the hwmon device and before registering the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released. Add "shutdown" flag to indicate that device shutdown is in progress to prevent workers from being re-armed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB