CVE-2026-98198

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pwm-fan) Stop RPM timer before freeing tach data sample_timer() rearms the RPM timer and accesses the devm-managed ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action which stops the timer is registered before those arrays are allocated. Since devres releases entries in reverse order, driver detach can free the arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry in that window accesses the freed tach data. With a KASAN kernel, a test-only kprobe delayed entry to pwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs reported three four-byte reads and two four-byte writes in sample_timer() after its backing devm allocations had been freed. The helper did not invoke the timer callback, cleanup actions or free functions. With the fix, three matching unbind runs completed without KASAN, BUG, WARNING, Oops or panic. Instrumentation confirmed that timer retirement completed before the first timer backing allocation was released. Split timer retirement from the power cleanup and register its devres action after the timer backing data and IRQ actions are installed. This preserves the early power rollback action while ensuring the timer is retired before its backing data is released. Use timer_shutdown_sync() because the callback can rearm itself.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98198

EUVD

EUVD-2026-93126

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	01695410d4529e38fea6159fa9f1260c598290b0
Linux	Linux	01695410d4529e38fea6159fa9f1260c598290b0
Linux	Linux	01695410d4529e38fea6159fa9f1260c598290b0
Linux	Linux	01695410d4529e38fea6159fa9f1260c598290b0
Linux	Linux	5.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the pwm-fan driver where the RPM timer is rearmed before its backing data (tach data and pulses_per_revolution arrays) is allocated. When the driver detaches, the cleanup function may free these arrays before the timer is stopped, leading to use-after-free errors. The fix ensures the timer is retired before its backing data is released.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem, particularly the pwm-fan driver. Detection requires checking kernel logs for timer-related errors or crashes during driver unbind operations. Use commands like 'dmesg | grep -i timer' or 'journalctl -k | grep -i timer' to look for timer expiry issues after unbind events.

Impact Analysis

This vulnerability could cause system instability, crashes, or kernel panics if exploited. It may lead to memory corruption, data corruption, or unexpected behavior in systems using the pwm-fan driver. Systems with KASAN enabled may detect memory access violations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level Linux kernel driver issue related to memory management and timer handling. Compliance impacts would depend on system-specific configurations and usage rather than the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-98198. The fix ensures timer retirement completes before backing data is released. Check your distribution's security advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-98198. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70