CVE-2026-74552

Received Received - Intake

NULL Pointer Dereference in Linux Kernel hwmon lm90 Driver

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initialized. This can trigger a NULL pointer access since lm90_update_device() and with it lm90_update_alarms_locked() will be called. This call schedules report_work and lm90_report_alarms(), which passes the still-NULL data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer dereference. Fix the problem by only scheduling the report and alert workers data->hwmon_dev is set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74552

EUVD

EUVD-2026-59617

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's hwmon subsystem, specifically in the lm90 driver. It occurs when userspace reads sysfs attributes before the driver finishes initialization. The driver's data->hwmon_dev is not yet set, causing a crash when alarm reporting functions try to access it.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem, particularly the lm90 driver. Detection requires checking kernel logs for NULL pointer dereference errors related to hwmon or lm90. Use commands like 'dmesg | grep -i lm90' or 'journalctl -k | grep -i null pointer' to search for relevant errors.

Impact Analysis

This vulnerability can cause system crashes or kernel panics when certain sysfs files are accessed during driver initialization. It may lead to denial-of-service conditions on affected systems running the vulnerable kernel version.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue causing a NULL pointer dereference in the hwmon subsystem, which could lead to system instability or crashes. No data exposure or privacy implications are described in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel security advisories and apply patches promptly. If immediate patching is not possible, consider disabling the lm90 driver module if not required.

Hi! I’m here to help you understand CVE-2026-74552. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70