CVE-2026-64213 Overview
CVE-2026-64213 is a race condition vulnerability in the Linux kernel's hwmon subsystem, specifically in the lm90 temperature sensor driver. The lm90_alert() function executes in the SMBus alert context and calls lm90_update_confreg() to disable the hardware alert line without acquiring hwmon_lock. Concurrent sysfs write operations that hold the lock can overwrite the alert handler's modifications to data->config and the hardware register. This unintentionally re-enables the hardware alert line while the alarm remains active, causing an interrupt storm.
Critical Impact
A concurrent sysfs write and alert interrupt can trigger an interrupt storm on affected systems, degrading kernel responsiveness and potentially leading to denial of service.
Affected Products
- Linux kernel hwmon subsystem — lm90 driver
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- Systems using LM90-family temperature sensors on SMBus with alert interrupts enabled
Discovery Timeline
- 2026-07-24 - CVE-2026-64213 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64213
Vulnerability Analysis
The lm90 driver manages temperature monitoring chips over SMBus and supports hardware alert interrupts. When an alarm fires, the kernel invokes lm90_alert() in the SMBus alert context. That handler calls lm90_update_confreg() to modify the chip's configuration register and mask the alert line until software clears the condition. The handler does not acquire hwmon_lock while performing this read-modify-write operation.
Sysfs write paths such as lm90_write_convrate() legitimately acquire hwmon_lock, temporarily change data->config, write the value to hardware, then restore the previous state. When these two code paths run concurrently, the sysfs path's restore step overwrites the alert handler's changes to both the in-memory shadow (data->config) and the hardware register.
The result is that the alert line is re-enabled while the underlying alarm condition remains active. The chip immediately re-asserts the interrupt, and the cycle repeats, producing an interrupt storm that consumes CPU cycles servicing an alarm that cannot be silenced. This is a classic concurrency defect in kernel driver code.
Root Cause
The root cause is a missing lock acquisition in lm90_alert(). The driver relies on hwmon_lock to serialize read-modify-write access to data->config and the corresponding hardware register, but the alert interrupt path bypasses this synchronization. The defect is a race condition between an interrupt handler and a sysfs writer sharing mutable driver state.
Attack Vector
Exploitation requires local access to a system with an LM90-family sensor exposed via hwmon sysfs and a physical condition that triggers the hardware alert. A local user with permission to write LM90 sysfs attributes (typically root) can time writes against alert events. The practical impact is denial of service through interrupt storms rather than code execution or privilege escalation. There is no known remote attack vector and no confirmed in-the-wild exploitation.
The vulnerability manifests only when the alert interrupt path and a sysfs writer contend for data->config. See the referenced kernel git commits for the exact code paths and the applied fix.
Detection Methods for CVE-2026-64213
Indicators of Compromise
- Sustained high interrupt rate on the SMBus controller line associated with an LM90 sensor visible in /proc/interrupts.
- Elevated ksoftirqd or IRQ handler CPU utilization correlated with hwmon sysfs write activity.
- Kernel log entries referencing repeated lm90_alert invocations without corresponding alarm clearing.
Detection Strategies
- Compare the running kernel version against the fixed commits 873e919e3101, b0b66aae8a94, and bed1fc32e0eb in the stable tree.
- Audit deployed kernel packages across the fleet to identify hosts still running affected lm90 driver revisions.
- Correlate hardware alarm events with sysfs write activity to hwmon attributes as an indicator of the race condition being triggered.
Monitoring Recommendations
- Monitor per-CPU interrupt counts and alert on sudden sustained increases tied to SMBus or hwmon sources.
- Track kernel ring buffer messages from the lm90 driver for repeated alert entries.
- Ingest kernel telemetry into a centralized data lake to enable cross-host trend analysis of interrupt behavior.
How to Mitigate CVE-2026-64213
Immediate Actions Required
- Apply the upstream stable kernel updates that include the lm90_alert lock protection fix.
- Prioritize patching on systems where LM90-family sensors are actively used with alert interrupts enabled.
- Restrict write access to hwmon sysfs attributes to trusted administrators only.
Patch Information
The fix adds the missing hwmon_lock acquisition to lm90_alert(), serializing the alert path against sysfs writers. The upstream commits are 873e919e3101063a7a75989510ccfc125a4391cf, b0b66aae8a94c3663d47e4000b0e81b89ce32186, and bed1fc32e0eb653806fa98afcf55f9a311fc4ce2 in the Linux kernel stable tree. Consumers should install the vendor-provided kernel package that incorporates these commits for their distribution.
Workarounds
- Disable the hardware alert interrupt for the affected LM90 sensor where operational requirements permit, relying on polled monitoring instead.
- Avoid concurrent sysfs writes to lm90 attributes during periods when hardware alarms are expected.
- Limit access to hwmon sysfs write endpoints through file permissions and mandatory access control policies until the patch is applied.
# Verify running kernel and check for fixed commits
uname -r
# Inspect the loaded lm90 module
modinfo lm90 | grep -E 'filename|version|srcversion'
# Review interrupt activity for the SMBus/hwmon line
grep -E 'i2c|smbus|lm90' /proc/interrupts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
