CVE-2026-97582

Summary

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (gpio-fan) Fix use-after-free in alarm work

fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels it. fan_alarm_notify() dereferences fan_data and its hwmon device. On unbind, devres frees the interrupt, which only waits for the handler itself, and then releases the hwmon device and fan_data, so a pending fan_alarm_notify() can run after those frees.

Replace INIT_WORK() with devm_work_autocancel(), registered before devm_request_irq(). The devres cleanup then frees the interrupt first, so no new work can be queued, and cancels the work while fan_data and the hwmon device are still alive.

This issue was found by an in-house static analysis tool.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxd6fe1360f42e86262153927986dea6502daff703 < 9b12bd724db9db318e3a68be17693583dc29a066affected
LinuxLinuxd6fe1360f42e86262153927986dea6502daff703 < 30755d3a5782cd704c8921cac8ee66dffe4383eaaffected
LinuxLinuxd6fe1360f42e86262153927986dea6502daff703 < c6ab7f855891877a16d2e2ddf0cd0305fd098a85affected
LinuxLinuxd6fe1360f42e86262153927986dea6502daff703 < a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293affected
LinuxLinux2.6.37affected
LinuxLinux0 < 2.6.37unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc3 <= *unaffected

Weaknesses

References