CVE-2026-98000
Received Received - Intake

hwmon: Fix UAF in pec_store via scoped_guard

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: Fix potential UAF in pec_store Sashiko reports: In pec_store(), a guard(mutex)(&hwdev->lock) is taken. If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls put_device(hdev). If this drops the final reference, the device is freed. When the function then returns, the guard cleanup function runs and attempts to unlock the freed mutex. Use scoped_guard() instead of guard() to avoid the problem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98000
EUVD
EUVD-2026-86653

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's hwmon subsystem. It occurs in the pec_store function where a mutex is locked, but if a chip write operation fails with an error other than -EOPNOTSUPP, the function jumps to a cleanup label that releases the device. If this is the last reference, the device is freed while the mutex is still locked. When the function returns, the cleanup code tries to unlock the already freed mutex, leading to undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem and requires kernel-level detection. Check kernel logs for hwmon-related errors or crashes using dmesg | grep hwmon. Monitor for mutex-related warnings or use ftrace to trace mutex operations in the hwmon code path.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior if exploited. It may lead to privilege escalation or denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the hwmon UAF issue. If immediate patching is not possible, disable the affected hwmon device or restrict access to the device file to reduce exposure until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart