CVE-2026-64038 Overview
CVE-2026-64038 is a use-after-free vulnerability in the Linux kernel's lm90 hardware monitoring (hwmon) driver. The flaw exists in the device probe teardown sequence, where delayed workers can dereference freed memory belonging to an already-released hwmon device. The issue arises from incorrect ordering of devm (device-managed) cleanup actions registered during lm90_probe(). When module unbind or probe failure triggers cleanup, the hwmon device is released before the alert_work and report_work handlers are cancelled, creating a window in which lm90_update_alarms() can access freed data.
Critical Impact
A race between hwmon device teardown and pending lm90_alert_work() or lm90_report_alarms() execution can dereference the freed data->hwmon_dev, causing kernel memory corruption or a system crash.
Affected Products
- Linux kernel builds including the lm90 hwmon driver prior to the fix
- Stable kernel branches referenced by commits 479e297526ae, b09a45601094, and c98107817b0f
- Systems using LM90-family temperature sensor hardware exposed through hwmon
Discovery Timeline
- 2026-07-19 - CVE-2026-64038 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64038
Vulnerability Analysis
The lm90 driver manages temperature sensor hardware and schedules delayed work items for alerts and alarm reporting. During lm90_probe(), lm90_init_client() registers a devm cleanup action (lm90_restore_conf) responsible for cancelling alert_work and report_work. This registration occurs before devm_hwmon_device_register_with_info() runs.
The devm framework executes cleanup callbacks in reverse registration order. On module unbind or probe failure, the hwmon device is unregistered and freed first, and the work-cancellation action runs afterward. Between these two steps, a pending lm90_alert_work() or lm90_report_alarms() invocation may execute and call lm90_update_alarms(), which dereferences data->hwmon_dev after it has already been released. This yields a classic use-after-free condition in kernel context.
Root Cause
The root cause is incorrect ordering of devm-managed resource cleanup. Because devm cleanup is LIFO, registering the work-cancellation action before the hwmon device registration guarantees the workers outlive the hwmon device during teardown. No synchronization prevents queued workers from running against freed state, and no shutdown indicator blocks re-arming of the work items during teardown.
Attack Vector
Exploitation requires local conditions that trigger lm90 module unbind or probe failure while alert_work or report_work is queued. This is primarily a stability and memory-safety defect. Triggering the race generally requires local privileges to unbind the driver or produce probe failures, and kernel memory corruption may follow depending on allocator state.
The upstream fix cancels the workers explicitly after registering the hwmon device and before installing the interrupt handler, ensuring workers are stopped after interrupts are disabled and before the hwmon device is released. A new shutdown flag prevents workers from being re-armed during teardown. See the Kernel Git Commit Details, Kernel Git Commit Changes, and Kernel Git Commit Update for the exact patch content.
Detection Methods for CVE-2026-64038
Indicators of Compromise
- Kernel oops or panic entries in dmesg referencing lm90_update_alarms, lm90_alert_work, or lm90_report_alarms around driver unbind events.
- KASAN use-after-free reports naming hwmon_dev or struct lm90_data on kernels with sanitizers enabled.
- Unexpected lm90 driver unbind or rebind events in system logs on hosts with LM90-family sensors.
Detection Strategies
- Enable KASAN in test kernels to surface use-after-free access to freed hwmon_dev structures during driver unbind.
- Audit installed kernel package versions against distributor advisories referencing the upstream lm90 fix commits.
- Monitor /sys/class/hwmon device churn on systems where lm90 bind and unbind cycles are not expected.
Monitoring Recommendations
- Alert on kernel log entries containing BUG:, KASAN:, or Oops: correlated with lm90 symbol names.
- Track driver bind/unbind operations via udev events for hwmon-class devices to detect abnormal teardown patterns.
- Baseline expected lm90 probe activity so that unusual repeated probe failures become visible.
How to Mitigate CVE-2026-64038
Immediate Actions Required
- Update to a Linux kernel version that includes commits 479e297526ae, b09a45601094, or c98107817b0f from the stable trees.
- Restrict local access to systems using the lm90 driver, since triggering the race requires local ability to unbind the driver or force probe failure.
- Avoid manual unbind operations on the lm90 driver on production hosts until the patched kernel is deployed.
Patch Information
The upstream fix restructures lm90_probe() so that cancel_delayed_work_sync() on alert_work and report_work runs explicitly after devm_hwmon_device_register_with_info() succeeds and before the interrupt handler is registered. A new shutdown flag on the driver private data prevents workers from being re-armed during teardown. Patch content is available in the Kernel Git Commit Details, Kernel Git Commit Changes, and Kernel Git Commit Update.
Workarounds
- Blacklist the lm90 module on systems that do not require LM90 temperature sensor telemetry until the kernel is patched.
- Prevent non-root users from performing driver bind/unbind operations by ensuring standard permissions on /sys/bus/i2c/drivers/lm90/ remain root-owned.
- Avoid I2C bus operations that could induce repeated lm90 probe failures on affected kernels.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
