CVE-2026-97582hwmon: (gpio-fan) Fix use-after-free in alarm work
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels it. fan_alarm_notify() dereferences fan_data and its hwmon device. On unbind, devres frees the interrupt, which only waits for the handler itself, and then releases the hwmon device and fan_data, so a pending fan_alarm_notify() can run after those frees. Replace INIT_WORK() with devm_work_autocancel(), registered before devm_request_irq(). The devres cleanup then frees the interrupt first, so no new work can be queued, and cancels the work while fan_data and the hwmon device are still alive. This issue was found by an in-house static analysis tool.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d6fe1360f42e86262153927986dea6502daff703 before 594c62eea7c82f526054496e9fa9b895122a8016; from d6fe1360f42e86262153927986dea6502daff703 before 6e67d9bdac810edacef78cbaeedd34445aa8ceb7; from d6fe1360f42e86262153927986dea6502daff703 before e9fc7d53b2eb34c0a607d1659f49b46911aaf16c; from d6fe1360f42e86262153927986dea6502daff703 before 9b12bd724db9db318e3a68be17693583dc29a066; from d6fe1360f42e86262153927986dea6502daff703 before 30755d3a5782cd704c8921cac8ee66dffe4383ea; from d6fe1360f42e86262153927986dea6502daff703 before c6ab7f855891877a16d2e2ddf0cd0305fd098a85; from d6fe1360f42e86262153927986dea6502daff703 before a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293 | CNA record |
References
- https://git.kernel.org/stable/c/594c62eea7c82f526054496e9fa9b895122a8016
- https://git.kernel.org/stable/c/6e67d9bdac810edacef78cbaeedd34445aa8ceb7
- https://git.kernel.org/stable/c/e9fc7d53b2eb34c0a607d1659f49b46911aaf16c
- https://git.kernel.org/stable/c/9b12bd724db9db318e3a68be17693583dc29a066
- https://git.kernel.org/stable/c/30755d3a5782cd704c8921cac8ee66dffe4383ea
- https://git.kernel.org/stable/c/c6ab7f855891877a16d2e2ddf0cd0305fd098a85
- https://git.kernel.org/stable/c/a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.