Linux Kernel EUVD-2026-48621

The vulnerable system must be running a Linux kernel version from 5.3 (introduced at commit 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f) through the unpatched commit ranges, with LM90-family temperature sensor hardware physically present and the lm90 kernel module loaded. The race condition requires that an SMBus alert interrupt from the sensor occurs concurrently with a sysfs write operation to an hwmon attribute (such as convrate) - both the alert condition and a concurrent sysfs write must be present. Local access with at least low-privilege user rights is required to trigger sysfs writes that participate in the race. The timing window is narrow, requiring either a sustained alarm condition from the sensor or deliberate repeated sysfs writes during an active alert. Systems without LM90-family sensors, or with the lm90 module not loaded, are entirely unaffected regardless of kernel version.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) correctly places this as a local, low-privilege denial-of-service. The assigned AC:L is arguably lenient - interrupt storm requires winning a concurrent timing race between an SMBus alert and a sysfs write, which typically maps to AC:H in CVSS 3.1. EPSS at 0.17% (6th percentile) aligns with the low real-world exploitation likelihood: the attack surface is narrow (requires LM90-family sensor hardware, the lm90 module loaded, local access, and a triggerable alert condition), and the impact is availability-only with no confidentiality or integrity consequence. The 'Information Disclosure' tag present in EUVD source data appears to be a mislabeling - the CVSS vector explicitly shows C:N/I:N, and the description describes only an interrupt storm DoS. No KEV listing and no known POC further reduce urgency. For most environments, this is a low-priority patch unless lm90-equipped hardware is safety-critical (e.g., industrial or server thermal management systems where interrupt storms could mask or cascade into other failures).

A local user with standard privileges on a Linux server or embedded system with LM90-family temperature sensors repeatedly writes to the hwmon sysfs convrate attribute in a tight loop while the sensor is in an active alarm state. The concurrent sysfs restore of data->config races against the lm90_alert() interrupt handler's attempt to clear the alert enable bit; when the sysfs path wins the race and commits its restored value, the hardware alert line is re-enabled while the alarm remains active, triggering a self-perpetuating interrupt storm that degrades or halts system responsiveness. No public exploit code is known for this vulnerability.