CVE-2026-64213
Received Received - Intake

Race Condition in Linux Kernel hwmon lm90 Driver

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock. Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it. If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register. This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm. Add the missing lock to lm90_alert() to solve the problem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64213
EUVD
EUVD-2026-48621

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's hwmon subsystem, specifically affecting the lm90 temperature sensor driver. It involves a race condition where the lm90_alert function modifies hardware alert settings without proper locking. Concurrent sysfs write operations can overwrite these changes, unintentionally re-enabling the hardware alert line while an alarm is active. This causes an interrupt storm as the system repeatedly processes alerts.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem, particularly the lm90 driver. Detection requires checking kernel logs for hardware alert storms or unexpected interrupts from the lm90 sensor. Monitor /var/log/kern.log or use dmesg for errors related to lm90 or hwmon. No direct commands detect this flaw, but monitoring for interrupt storms or sysfs write conflicts may indicate exploitation.

Impact Analysis

This vulnerability could lead to system instability due to excessive interrupt handling, potentially causing performance degradation or system hangs. It may also result in incorrect temperature monitoring if the alert system is disrupted. Systems relying on the lm90 sensor for critical thermal management could experience failures.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local kernel-level issue involving race conditions in hardware monitoring (hwmon) drivers, which could lead to system instability or denial of service but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64213. The patch adds lock protection to lm90_alert() to prevent concurrent sysfs write operations from interfering with hardware alert handling. Check your distribution's security advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart