CVE-2026-64213

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel hwmon lm90 Driver

Publication date: 2026-07-24

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock. Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it. If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register. This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm. Add the missing lock to lm90_alert() to solve the problem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64213

EUVD

EUVD-2026-48621

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.3 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's hwmon subsystem, specifically affecting the lm90 temperature sensor driver. It involves a race condition where the lm90_alert function modifies hardware alert settings without proper locking. Concurrent sysfs write operations can overwrite these changes, unintentionally re-enabling the hardware alert line while an alarm is active. This causes an interrupt storm as the system repeatedly processes alerts.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem, particularly the lm90 driver. Detection requires checking kernel logs for hardware alert storms or unexpected interrupts from the lm90 sensor. Monitor /var/log/kern.log or use dmesg for errors related to lm90 or hwmon. No direct commands detect this flaw, but monitoring for interrupt storms or sysfs write conflicts may indicate exploitation.

Impact Analysis

This vulnerability could lead to system instability due to excessive interrupt handling, potentially causing performance degradation or system hangs. It may also result in incorrect temperature monitoring if the alert system is disrupted. Systems relying on the lm90 sensor for critical thermal management could experience failures.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local kernel-level issue involving race conditions in hardware monitoring (hwmon) drivers, which could lead to system instability or denial of service but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64213. The patch adds lock protection to lm90_alert() to prevent concurrent sysfs write operations from interfering with hardware alert handling. Check your distribution's security advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-64213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70