PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64038 Linux CVE debrief

A Linux kernel vulnerability, CVE-2026-64038, was resolved by stopping work before releasing the hwmon device. The issue arose from the devm action to cancel alert_work and report_work being registered before devm_hwmon_device_register_with_info(). This led to a potential race condition where lm90_alert_work() or lm90_report_alarms() could run after the hwmon device was freed, causing lm90_update_alarms() to dereference freed data. The fix ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel users and maintainers should be aware of this vulnerability and ensure they apply the fix to prevent potential issues. This includes users of Linux-based systems, developers working with the Linux kernel, and security teams responsible for monitoring and patching vulnerabilities. The vulnerability has a high priority for Linux kernel maintainers and users due to potential for exploitation.

Technical summary

The vulnerability was found in the lm90 driver, which is part of the Linux kernel's hwmon subsystem. The driver was not properly synchronizing the cancellation of delayed works with the registration and unregistration of the hwmon device. This could lead to a use-after-free condition if the delayed works were executed after the hwmon device was freed. The fix ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released, preventing potential exploitation.

Defensive priority

High priority for Linux kernel maintainers and users due to potential for exploitation.

Recommended defensive actions

  • Apply the official patch to cancel workers separately after registering the hwmon device and before registering the interrupt handler.
  • Ensure Linux kernel is updated with the fix.
  • Monitor for any potential exploits or issues related to this vulnerability.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence is limited; primary official records indicate a fix was applied to the Linux kernel to address the vulnerability. The fix involves canceling workers separately after registering the hwmon device and before registering the interrupt handler. Linux kernel users should verify their systems and apply the patch to prevent potential issues. The vulnerability was found in the lm90 driver, which is part of the Linux kernel's hwmon subsystem. The driver was not properly synchronizing the cancellation of delayed works with the registration and unregistration of the hwmon device.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:44.053Z and has not been modified since then.