CVE-2026-97582

UNKNOWN 0.0

hwmon: (gpio-fan) Fix use-after-free in alarm work

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels it. fan_alarm_notify() dereferences fan_data and its hwmon device. On unbind, devres frees the interrupt, which only waits for the handler itself, and then releases the hwmon device and fan_data, so a pending fan_alarm_notify() can run after those frees. Replace INIT_WORK() with devm_work_autocancel(), registered before devm_request_irq(). The devres cleanup then frees the interrupt first, so no new work can be queued, and cancels the work while fan_data and the hwmon device are still alive. This issue was found by an in-house static analysis tool.

Vendor	linux
Product	linux
Ecosystems	Linux Kernel
Industries	Technology
Published	Sep 25, 2026
Last Updated	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for linux linux

Be the first to know when new unknown vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Linux / Linux

d6fe1360f42e86262153927986dea6502daff703 < 7f96803f612134f585ab3b39e6d5b2d4b9c0606f d6fe1360f42e86262153927986dea6502daff703 < 594c62eea7c82f526054496e9fa9b895122a8016 d6fe1360f42e86262153927986dea6502daff703 < 6e67d9bdac810edacef78cbaeedd34445aa8ceb7 d6fe1360f42e86262153927986dea6502daff703 < e9fc7d53b2eb34c0a607d1659f49b46911aaf16c d6fe1360f42e86262153927986dea6502daff703 < 9b12bd724db9db318e3a68be17693583dc29a066 d6fe1360f42e86262153927986dea6502daff703 < 30755d3a5782cd704c8921cac8ee66dffe4383ea d6fe1360f42e86262153927986dea6502daff703 < c6ab7f855891877a16d2e2ddf0cd0305fd098a85 d6fe1360f42e86262153927986dea6502daff703 < a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293

Linux / Linux

2.6.37

References

NVD ↗ CVE.org ↗ EPSS Data ↗