CVE-2026-89937: Linux Kernel SGP30 Privilege Escalation Flaw

CVE-2026-89937 Overview

CVE-2026-89937 is a Linux kernel vulnerability in the Industrial I/O (IIO) chemical sensor driver for the Sensirion SGP30/SGP40 gas sensors. The sgp_probe() function calls kthread_run() to start the Indoor Air Quality (IAQ) thread but fails to check for an error pointer return. The driver stores the invalid pointer and reports probe success. When the device is later removed, sgp_remove() passes the error pointer to kthread_stop(), triggering undefined kernel behavior.

Critical Impact
Improper error handling in the sgp30 driver can lead to kernel instability when a device is unbound after a failed thread creation.

Affected Products

Linux kernel iio chemical sensor subsystem
sgp30 driver supporting Sensirion SGP30 and SGP40 gas sensors
Multiple stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-09-16 - CVE-2026-89937 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89937

Vulnerability Analysis

The defect resides in the sgp_probe() routine of the sgp30 IIO driver. The code invokes kthread_run() to launch the IAQ measurement thread, then assigns the returned task_struct pointer to the device state without verifying it with IS_ERR(). The Linux kernel convention returns an encoded error pointer, not NULL, when kthread_run() fails. Because the probe function still returns success, the device registers in a partially initialized state without an active IAQ thread.

The consequence surfaces during driver teardown. sgp_remove() unconditionally calls kthread_stop() on the stored pointer. Passing an ERR_PTR value to kthread_stop() dereferences an invalid kernel address, producing a kernel oops or memory corruption. The upstream fix returns the error from probe so the device never registers when thread creation fails.

Root Cause

The root cause is a missing return-value check that classifies as an improper input validation defect on a kernel API result. The driver treats an error pointer as a valid task_struct, violating the documented kthread_run() contract.

Attack Vector

Exploitation requires a local trigger path that induces kthread_run() failure, such as memory pressure or process table exhaustion, followed by a subsequent driver unbind. The scenario is constrained to systems with the SGP30/SGP40 sensor bound to the vulnerable driver. See the upstream patches for the exact code change:

Detection Methods for CVE-2026-89937

Indicators of Compromise

Kernel oops or panic entries referencing kthread_stop invoked from sgp_remove
dmesg entries showing probe success for sgp30 followed by missing IAQ measurement activity
Crash traces occurring during module unload of sgp30 or device unbind operations

Detection Strategies

Audit running kernel versions against the fixed commits published on git.kernel.org for the iio/chemical/sgp30 path
Correlate host telemetry that ingests /var/log/kern.log or journald for kthread_stop fault signatures
Inventory hardware bindings to identify hosts with SGP30/SGP40 sensors exposed through the IIO subsystem

Monitoring Recommendations

Alert on kernel warnings or oops messages that reference sgp30, sgp_probe, or sgp_remove
Track driver bind and unbind events in /sys/bus/i2c/drivers/sgp30/ for unexpected activity
Monitor kernel taint flags after driver removal to catch instability introduced by the bug

How to Mitigate CVE-2026-89937

Immediate Actions Required

Apply the upstream stable kernel updates that include the referenced fix commits
Rebuild and redeploy custom kernels that carry the sgp30 driver to include the corrected probe error path
Restrict sgp30 driver load to hosts with the physical sensor to reduce exposure

Patch Information

The fix returns the error from sgp_probe() when kthread_run() fails, preventing registration of a device without its IAQ thread. Patches are available across multiple stable branches, including commits 1135d687, 2d386efb, 3462c13b, 3c6b52b2, 44d52c8b, a5aaea17, bae0316c, and bffd0655.

Workarounds

Blacklist the sgp30 module on systems that do not require the sensor until the patched kernel is deployed
Avoid unbinding the sgp30 driver on unpatched hosts to prevent triggering the kthread_stop() fault path
Prefer distributor-signed kernel updates over local rebuilds where feasible to inherit the vendor validation cycle

bash

# Blacklist the sgp30 driver until a patched kernel is installed
echo "blacklist sgp30" | sudo tee /etc/modprobe.d/blacklist-sgp30.conf
sudo update-initramfs -u