In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In… (CVE-2026-64038)
A use-after-free vulnerability in the Linux kernel's hwmon lm90 driver was resolved. The issue occurred because delayed work tasks could run after the hwmon device was freed but before the work was canceled, leading to dereferencing freed memory. The fix involves canceling the workers after registering the hwmon device and before registering the interrupt handler, and adding a shutdown flag to prevent re-arming of workers during device shutdown.
AI Analysis
Technical Summary
CVE-2026-64038 is a vulnerability in the Linux kernel's hwmon lm90 driver where delayed work tasks (lm90_alert_work and lm90_report_alarms) could execute after the hwmon device was freed, causing a use-after-free condition. This happens because devm cleanup actions run in reverse order, unregistering and freeing the hwmon device before canceling the delayed works. The flaw was fixed by ensuring the workers are canceled after the device registration and before interrupt handler registration, and by adding a shutdown flag to prevent workers from being re-armed during shutdown.
Potential Impact
The vulnerability could lead to kernel memory corruption or crashes due to dereferencing freed memory in the hwmon lm90 driver. This may affect system stability or security depending on the context in which the driver is used. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by properly ordering the cancellation of delayed work and adding a shutdown flag. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed here; check the Linux kernel vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In… (CVE-2026-64038)
Description
A use-after-free vulnerability in the Linux kernel's hwmon lm90 driver was resolved. The issue occurred because delayed work tasks could run after the hwmon device was freed but before the work was canceled, leading to dereferencing freed memory. The fix involves canceling the workers after registering the hwmon device and before registering the interrupt handler, and adding a shutdown flag to prevent re-arming of workers during device shutdown.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64038 is a vulnerability in the Linux kernel's hwmon lm90 driver where delayed work tasks (lm90_alert_work and lm90_report_alarms) could execute after the hwmon device was freed, causing a use-after-free condition. This happens because devm cleanup actions run in reverse order, unregistering and freeing the hwmon device before canceling the delayed works. The flaw was fixed by ensuring the workers are canceled after the device registration and before interrupt handler registration, and by adding a shutdown flag to prevent workers from being re-armed during shutdown.
Potential Impact
The vulnerability could lead to kernel memory corruption or crashes due to dereferencing freed memory in the hwmon lm90 driver. This may affect system stability or security depending on the context in which the driver is used. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by properly ordering the cancellation of delayed work and adding a shutdown flag. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed here; check the Linux kernel vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-35qx-2fp8-64h3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64038"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912cf08
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:56:49 UTC
Last updated: 07/20/2026, 17:28:09 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.