Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm_iio_trigger_register tmp006_probe() allocates… (CVE-2026-64492)
A vulnerability in the Linux kernel's iio temperature driver (tmp006) was resolved. The issue involved improper registration and deregistration of a trigger, leading to a dangling pointer when the module was unloaded. This could cause instability or undefined behavior in the kernel. The vulnerability affects Linux hardware enablement (HWE) kernels prior to certain 7.0.0 versions. A patch is available and included in updated kernel packages. Users should update and reboot to apply the fix.
AI Analysis
Technical Summary
The Linux kernel's iio temperature tmp006 driver allocated a data-ready (DRDY) trigger with devm_iio_trigger_alloc() but registered it with iio_trigger_register() instead of devm_iio_trigger_register(). Because the driver lacks a .remove() callback, on module unload the trigger remains in the global trigger list while its memory is freed by devm, leaving a dangling entry. The fix switches to devm_iio_trigger_register() so that registration is undone within the same devm scope as allocation, preventing dangling pointers. This vulnerability affects Linux kernel versions prior to 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-1011.11~24.04.1, and 7.0.0-1012.12~24.04.1 in the linux-hwe-edge product. The vendor advisory confirms a patch is available and advises updating to fixed kernel versions.
Potential Impact
If exploited, the dangling pointer could cause kernel instability or crashes when the module is unloaded, potentially leading to denial of service or other unpredictable kernel behavior. There is no indication of active exploitation or privilege escalation from this specific flaw. The impact is primarily on system stability and reliability.
Mitigation Recommendations
A patch is available and included in updated Linux kernel packages for the affected Ubuntu releases. Users should apply the standard system update and reboot to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating to the fixed package versions.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm_iio_trigger_register tmp006_probe() allocates… (CVE-2026-64492)
Description
A vulnerability in the Linux kernel's iio temperature driver (tmp006) was resolved. The issue involved improper registration and deregistration of a trigger, leading to a dangling pointer when the module was unloaded. This could cause instability or undefined behavior in the kernel. The vulnerability affects Linux hardware enablement (HWE) kernels prior to certain 7.0.0 versions. A patch is available and included in updated kernel packages. Users should update and reboot to apply the fix.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's iio temperature tmp006 driver allocated a data-ready (DRDY) trigger with devm_iio_trigger_alloc() but registered it with iio_trigger_register() instead of devm_iio_trigger_register(). Because the driver lacks a .remove() callback, on module unload the trigger remains in the global trigger list while its memory is freed by devm, leaving a dangling entry. The fix switches to devm_iio_trigger_register() so that registration is undone within the same devm scope as allocation, preventing dangling pointers. This vulnerability affects Linux kernel versions prior to 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-1011.11~24.04.1, and 7.0.0-1012.12~24.04.1 in the linux-hwe-edge product. The vendor advisory confirms a patch is available and advises updating to fixed kernel versions.
Potential Impact
If exploited, the dangling pointer could cause kernel instability or crashes when the module is unloaded, potentially leading to denial of service or other unpredictable kernel behavior. There is no indication of active exploitation or privilege escalation from this specific flaw. The impact is primarily on system stability and reliability.
Mitigation Recommendations
A patch is available and included in updated Linux kernel packages for the affected Ubuntu releases. Users should apply the standard system update and reboot to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating to the fixed package versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fg54-gxf9-gvmv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64492"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542079c2644c7f8082675
Added to database: 07/25/2026, 23:08:55 UTC
Last enriched: 09/07/2026, 17:44:52 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.