VulnerabilityPublished 19 Jul 2026Updated 21 Oct 2026

CVE-2026-64038: Linux kernel · hwmon: (lm90) Stop work before releasing hwmon device

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c98107817b0f6cdf51adc5e84e75c39ee25d8b28 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.08% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c98107817b0f6cdf51adc5e84e75c39ee25d8b28, b09a45601094c7f4ec4db8090b825fa61e169d93, 479e297526aeb19c745eac5c1897f455f83dc5f8 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f6d0775119fb905fb02eafa98d575cf8ee792d46, < c98107817b0f6cdf51adc5e84e75c39ee25d8b28	Fixed in c98107817b0f6cdf51adc5e84e75c39ee25d8b28
LinuxLinux	Affected ≥ f6d0775119fb905fb02eafa98d575cf8ee792d46, < b09a45601094c7f4ec4db8090b825fa61e169d93	Fixed in b09a45601094c7f4ec4db8090b825fa61e169d93
LinuxLinux	Affected ≥ f6d0775119fb905fb02eafa98d575cf8ee792d46, < 479e297526aeb19c745eac5c1897f455f83dc5f8	Fixed in 479e297526aeb19c745eac5c1897f455f83dc5f8
LinuxLinux	Affected ≥ f6d0775119fb905fb02eafa98d575cf8ee792d46, < 5c116abf208dd97c4ceb76c5c50c9bc34a017796	Fixed in 5c116abf208dd97c4ceb76c5c50c9bc34a017796
LinuxLinux	Affected ≥ f6d0775119fb905fb02eafa98d575cf8ee792d46, < 1fe96176636cb17906680c098688b144bd9c1c45	Fixed in 1fe96176636cb17906680c098688b144bd9c1c45
LinuxLinux	Affected =6.0	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before devm_hwmon_device_register_with_info() is called. Because devm executes cleanup actions in reverse order during module unbind or probe failure, the hwmon device is unregistered and freed first. If lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here. Fix the problem by canceling the workers separately after registering the hwmon device and before registering the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released. Add "shutdown" flag to indicate that device shutdown is in progress to prevent workers from being re-armed.

References

Community reviews

Loading reviews…