hwmon: (lm90) Only report alarms if driver is ready (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.17 % · centile 7 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initialized. This can trigger a NULL pointer access since lm90_update_device() and with it lm90_update_alarms_locked() will be called. This call schedules report_work and lm90_report_alarms(), which passes the still-NULL data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer dereference. Fix the problem by only scheduling the report and alert workers data->hwmon_dev is set.
Références
- https://git.kernel.org/stable/c/31ce62d36d859423dc39f9902f7c4c307b2e00e3
- https://git.kernel.org/stable/c/4eed33c7db5c0c573928d28d8a2c003642c679b8
- https://git.kernel.org/stable/c/70d9a71aa407044d70b50d356b6decf6659c4d56
- https://git.kernel.org/stable/c/075fce376cf852db9293481edce07c181a9b1f46
- https://git.kernel.org/stable/c/f0b791a006512a48b6348494cb6960598fa99a58
- https://git.kernel.org/stable/c/aa9429edf9fc0e90d6f4da19ea4b5495a54ab117
Références européennes
- ENISA EUVD · EUVD-2026-59617
- GCVE · GCVE-0-2026-74552
Avis du CERT-FR
- CERTFR-2026-AVI-1232 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1090 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected f6d0775119fb905fb02eafa98d575cf8ee792d46 < 31ce62d36d859423dc39f9902f7c4c307b2e00e3 ; affected f6d0775119fb905fb02eafa98d575cf8ee792d46 < 4eed33c7db5c0c573928d28d8a2c003642c679b8 ; affected f6d0775119fb905fb02eafa98d575cf8ee792d46 < 70d9a71aa407044d70b50d356b6decf6659c4d56 ; affected f6d0775119fb905fb02eafa98d575cf8ee792d46 < 075fce376cf852db9293481edce07c181a9b1f46 ; affected f6d0775119fb905fb02eafa98d575cf8ee792d46 < f0b791a006512a48b6348494cb6960598fa99a58 ; affected f6d0775119fb905fb02eafa98d575cf8ee792d46 < aa9429edf9fc0e90d6f4da19ea4b5495a54ab117 |
| Linux · Linux | affected 6.0 ; unaffected 0 < 6.0 ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.151 ≤ 6.6.* ; unaffected 6.12.103 ≤ 6.12.* ; unaffected 6.18.44 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |