CVE-2026-64492: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64492 Overview

CVE-2026-64492 affects the Linux kernel's Industrial I/O (IIO) subsystem, specifically the tmp006 temperature sensor driver. The tmp006_probe() function allocates the Data Ready (DRDY) trigger using devm_iio_trigger_alloc() but registers it with the non-managed iio_trigger_register(). Because the driver lacks a .remove() callback, module unload leaves the trigger registered in the global trigger list while its underlying memory is released by the devm subsystem. The result is a dangling entry that can lead to use-after-free conditions when subsequent code walks the trigger list.

Critical Impact
Unloading the tmp006 driver leaves a dangling trigger entry in the kernel's global trigger list, creating a use-after-free condition in the IIO subsystem.

Affected Products

Linux kernel — drivers/iio/temperature/tmp006.c driver
Systems using the Texas Instruments TMP006 infrared thermopile sensor via IIO
Kernel branches receiving the fix per stable commits 3c5eed894e, a4f8491da9, and d90f868f56

Discovery Timeline

2026-07-25 - CVE-2026-64492 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64492

Vulnerability Analysis

The defect is a lifetime mismatch between allocation and registration APIs in a kernel driver. devm_iio_trigger_alloc() ties the allocated iio_trigger structure to the device's managed resource scope, so the memory is automatically freed when the device is unbound. However, iio_trigger_register() inserts the trigger into a global, kernel-wide list that persists independently of the device lifecycle.

Because tmp006 does not implement a .remove() callback, nothing calls iio_trigger_unregister() when the module unloads. The trigger structure is freed by devm, but the global list still holds a pointer to that freed memory. Any subsequent iteration of the IIO trigger list — for example, when another driver registers or looks up a trigger — dereferences freed memory, classifying this as a Use-After-Free [CWE-416] and a resource-management error [CWE-772].

Root Cause

The root cause is inconsistent use of device-managed (devm) APIs. The allocator was devm-managed, but the registration call was not. This asymmetry ensures that only one half of the lifecycle is properly cleaned up on device teardown.

Attack Vector

Exploitation requires local access with sufficient privileges to unload the tmp006 module on a system where the driver is bound to a physical or emulated TMP006 sensor. After unload, further IIO trigger operations may dereference the freed memory. In most deployments this is a stability and memory-safety issue rather than a remote attack vector, but memory corruption in kernel space can be leveraged for privilege escalation depending on allocator behavior and heap grooming.

No public exploit code is available for this issue. See the upstream fixes referenced in Kernel Git Commit 3c5eed894e, Kernel Git Commit a4f8491da9, and Kernel Git Commit d90f868f56 for the corrective patches, which replace the plain registration call with devm_iio_trigger_register().

Detection Methods for CVE-2026-64492

Indicators of Compromise

Kernel oops or panic messages referencing iio_trigger list traversal after tmp006 module removal
KASAN (Kernel Address Sanitizer) reports of use-after-free in the IIO subsystem tied to trigger registration paths
Unexpected rmmod tmp006 events on systems where the driver is expected to remain bound

Detection Strategies

Enable KASAN on test kernels to catch the dangling trigger dereference during driver load/unload cycles
Audit deployed kernel versions against the fixed stable commits 3c5eed894e, a4f8491da9, and d90f868f56
Review the tmp006.c source in your kernel tree to confirm registration uses devm_iio_trigger_register()

Monitoring Recommendations

Collect kernel ring buffer output (dmesg) centrally and alert on IIO-related BUG, WARN, or KASAN entries
Track module load/unload events for tmp006 through auditd rules on affected hosts
Correlate kernel crash telemetry with driver identifiers to surface repeated failures in the IIO trigger path

How to Mitigate CVE-2026-64492

Immediate Actions Required

Update to a Linux kernel version that includes the fix from commits 3c5eed894e, a4f8491da9, or d90f868f56
Avoid unloading the tmp006 module on unpatched systems where the driver is bound to a sensor
Restrict CAP_SYS_MODULE to trusted administrative accounts to limit who can trigger the unsafe unload path

Patch Information

The upstream fix replaces iio_trigger_register() with devm_iio_trigger_register() in tmp006_probe(), aligning the registration lifetime with the devm-managed allocation. Apply distribution kernel updates that incorporate the referenced stable commits. Verify the fix by inspecting drivers/iio/temperature/tmp006.c for the devm-managed registration call.

Workarounds

Blacklist the tmp006 module on systems that do not require the TMP006 sensor
If the driver must be loaded, keep it loaded for the lifetime of the system and disable dynamic module unload via sysctl kernel.modules_disabled=1 after boot
Deploy KASAN-enabled kernels in staging to detect regressions before production rollout

bash

# Configuration example: prevent module unload after boot
echo 'blacklist tmp006' | sudo tee /etc/modprobe.d/blacklist-tmp006.conf
sudo sysctl -w kernel.modules_disabled=1