Linux Kernel EUVD-2026-93125

Requires ALL of: (1) local access to the host (AV:L); (2) a system physically equipped with the Winbond W83791D sensor chip with the w83791d hwmon driver bound; (3) the fan/pwm 4-5 pins NOT configured as GPIO, so w83791d_probe() creates the w83791d_group_fanpwm45 sysfs group; and (4) the driver being unbound/removed via the normal teardown path, which leaves those sysfs files behind. Exploitation is LIMITED by the need to win a race between driver unbind (freeing devm data) and accessing the leftover sysfs attributes (AC:H), by local-only reach, and by the highly specific hardware/configuration prerequisites that make the vulnerable code path absent on the vast majority of systems. Unbinding the driver itself typically requires privileged access.

This is a genuine memory-safety flaw (use-after-free on devm-allocated driver data via stale sysfs files) but a LOW real-world priority. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N (base 7.0 HIGH) is internally consistent with the description: exploitation is strictly local (AV:L), requires winning a race / specific teardown conditions (AC:H), and needs existing low-level access (PR:L). All exploitation signals point the same way and do NOT conflict: EPSS is only 0.22% (11th percentile), there is no CISA KEV listing, and no public exploit was identified - so this is 'no public exploit identified at time of analysis.' The HIGH CVSS is driven entirely by the C:H/I:H/A:H kernel-memory impact, not by ease of exploitation; the AC:H and AV:L metrics sharply constrain practical risk. Critically, the vulnerable code path is the w83791d hwmon driver for a specific Winbond sensor chip, so the affected attack surface is far narrower than 'Linux' implies - most systems never load this driver. The 'Information Disclosure' tag understates impact, since the flaw is a use-after-free with full C/I/A impact per CVSS, not merely a read primitive - treat it as potential memory corruption, not just disclosure.

A local user on a system that has the Winbond W83791D hardware-monitoring chip and the w83791d driver loaded (with fan/pwm 4-5 pins not used as GPIO) interacts with the optional fan/pwm 4-5 sysfs attributes after the driver has been unbound. Because the normal remove path fails to delete the w83791d_group_fanpwm45 sysfs group, the attribute callbacks dereference devm-allocated driver data that was already freed at unbind, producing a use-after-free against stale kernel memory. No public exploit code was identified; exploitation also depends on winning the unbind/access race (reflected in AC:H).