Use-after-free in Linux kernel - CVE-2026-98200
Published: October 7, 2026
Vulnerability identifier: #VU153821
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98200
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read freed kernel memory.
The vulnerability exists due to use-after-free in fungible_show() in the hp-wmi-sensors driver when reading a sensor's current_state debugfs entry concurrently with a sensor state update that replaces the current_state string. A local user can trigger overlapping reads of the same sensor to read freed kernel memory.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98200
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/72c85149794a1ccf8d718ffed1521106b5d31968
- https://git.kernel.org/stable/c/9c1e65bc79ff104914b11e6ad972139296ec86fe
- https://git.kernel.org/stable/c/b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795
- https://git.kernel.org/stable/c/e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69
- https://git.kernel.org/stable/c/f59ecfd2c58bace39538f3fff7f43788b3fdb539