In the Linux kernel, the following vulnerability has been resolved:
Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.
Jean Delvare points out that the patch does not completely
fix the reported problem, that it in fact introduces a
(new) race condition, and that it may actually not be needed in
the first place.
Various AI reviews agree. Specific and relevant AI feedback:
"
This reordering sets the driver data to NULL before removing the sensor
attributes in the loop below.
ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but
does not check if it is NULL before dereferencing it to access
data->sensors[].
If a userspace process reads a sensor file (like temp1_input) while this
delete function is running, could it race with the dev_set_drvdata(...,
NULL) call here and crash in ibmpex_show_sensor()?
Would it be safer to keep the original order where device_remove_file() is
called before clearing the driver data? device_remove_file() should wait
for any active sysfs callbacks to complete, which might already prevent the
use-after-free this patch intends to fix.
"
Revert the offending patch. If it can be shown that the originally reported
alleged race condition does indeed exist, it can always be re-introduced
with a complete fix.
References
Configurations
Configuration 1 (hide)
|
History
24 Jun 2026, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| References | () https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a - Patch | |
| References | () https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64 - Patch | |
| References | () https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d - Patch | |
| References | () https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006 - Patch | |
| References | () https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1 - Patch | |
| References | () https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18 - Patch | |
| References | () https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5 - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
27 May 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 14:17
Updated : 2026-06-24 14:55
NVD link : CVE-2026-45914
Mitre link : CVE-2026-45914
CVE.ORG link : CVE-2026-45914
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free