SB20261007166 - Use-after-free in Linux kernel hwmon driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the pwm-fan driver's sample_timer() callback when detaching the driver while the RPM timer is active. A local user can trigger driver detachment during a timer expiry window to corrupt kernel memory.

The callback accesses device-managed tachometer arrays that can be freed before timer cleanup occurs. The callback can also rearm the RPM timer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1e824fdb14a187ce56697e803b02b1e86243a755
• https://git.kernel.org/stable/c/26d5ff79768548efb1e604bb6e8697c101e06269
• https://git.kernel.org/stable/c/a5ce3fe5335a24d0220958c6866830a6d5fa1cc0
• https://git.kernel.org/stable/c/b48339b0a577783e4590a69e4cd2f2760ce33154