CVE-2026-45914: Linux Kernel Race Condition Vulnerability

CVE-2026-45914 Overview

CVE-2026-45914 documents a Linux kernel change that reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d in the hwmon subsystem's ibmpex driver. The original commit attempted to fix a use-after-free in the high/low store path but introduced a new race condition without fully addressing the original report. Maintainers reverted the patch after review feedback indicated the change reordered driver data clearing before sysfs attribute removal, opening a window where ibmpex_show_sensor() could dereference a NULL pointer set via dev_set_drvdata(..., NULL).

Critical Impact
The reverted code path could allow a concurrent userspace read of a sensor file (such as temp1_input) to race with driver teardown, potentially producing a NULL pointer dereference in the kernel.

Affected Products

Linux kernel branches that previously merged commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d
Systems using the hwmonibmpex driver on IBM hardware exposing PowerExecutive sensors
Stable kernel trees referenced by the upstream revert commits

Discovery Timeline

2026-05-27 - CVE-2026-45914 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45914

Vulnerability Analysis

The ibmpex hwmon driver exposes IBM PowerExecutive sensor data through sysfs files. The original fix commit reordered driver teardown so that dev_set_drvdata(..., NULL) ran before the loop that calls device_remove_file() for each sensor attribute. Reviewer Jean Delvare and follow-up analysis identified that this reordering created a new race window: a concurrent read of a sensor file invokes ibmpex_show_sensor(), which retrieves driver data with dev_get_drvdata() and dereferences data->sensors[] without a NULL check.

If the teardown path clears the driver data first, the concurrent reader can dereference NULL and trigger a kernel oops. The maintainers concluded the original use-after-free report may not require a fix at all, because device_remove_file() already waits for active sysfs callbacks to complete before returning. The revert restores the prior ordering so attribute removal completes before driver data is cleared.

Root Cause

The root cause is incorrect ordering of teardown operations combined with a missing NULL check in the sysfs show callback. Clearing driver data prior to removing sysfs attributes broke the implicit synchronization that device_remove_file() provides against in-flight reads.

Attack Vector

An unprivileged local user reading sysfs files exposed by ibmpex while the driver unbinds or the device is removed could trigger the race. Exploitation requires local access, the presence of affected IBM hardware, and the ability to time userspace reads against driver teardown.

No verified exploit code is available. See the upstream revert in the Kernel Commit 894d9c7 and related stable backports for the exact change.

Detection Methods for CVE-2026-45914

Indicators of Compromise

Kernel oops or NULL pointer dereference messages referencing ibmpex_show_sensor or the ibmpex module in dmesg
Unexpected crashes or warnings during hwmon device unbind, driver unload, or hot-removal events
Abnormal process termination when reading files under /sys/class/hwmon/hwmon*/ on affected IBM systems

Detection Strategies

Audit deployed kernel versions to determine whether commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d is present without the revert in Kernel Commit 894d9c7
Monitor kernel ring buffer and journald output for stack traces involving ibmpex symbols
Correlate driver teardown events with concurrent reads of hwmon sysfs files in host telemetry

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized log platform for kernel oops correlation
Track lsmod and modprobe activity for ibmpex load and unload sequences on IBM server fleets
Alert on repeated kernel warnings from the hwmon subsystem across managed Linux hosts

How to Mitigate CVE-2026-45914

Immediate Actions Required

Apply the stable kernel update containing the revert from your distribution vendor
Inventory Linux hosts running the ibmpex driver and prioritize patching on IBM hardware exposing PowerExecutive sensors
Restrict local user access on affected systems until the revert is deployed

Patch Information

The fix is the revert itself, distributed across multiple stable branches. Reference commits: Kernel Commit 05112ba, Kernel Commit 14a3878, Kernel Commit 894d9c7, Kernel Commit 8bde3e3, Kernel Commit 914b47c, Kernel Commit efd6842, and Kernel Commit f448acd8.

Workarounds

Unload the ibmpex module with modprobe -r ibmpex on systems where PowerExecutive sensor data is not required
Blacklist the ibmpex module via /etc/modprobe.d/ until a patched kernel is installed
Limit access to /sys/class/hwmon/ so only trusted monitoring agents can read sensor files

bash

# Blacklist the ibmpex driver until a patched kernel is available
echo "blacklist ibmpex" | sudo tee /etc/modprobe.d/cve-2026-45914.conf
sudo modprobe -r ibmpex