CVE-2026-45914
published 2026-05-27CVE-2026-45914: In the Linux kernel, the following vulnerability has been resolved: Revert "hwmon: (ibmpex) fix use-after-free in high/low store" This reverts commit…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.
Jean Delvare points out that the patch does not completely
fix the reported problem, that it in fact introduces a
(new) race condition, and that it may actually not be needed in
the first place.
Various AI reviews agree. Specific and relevant AI feedback:
"
This reordering sets the driver data to NULL before removing the sensor
attributes in the loop below.
ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but
does not check if it is NULL before dereferencing it to access
data->sensors[].
If a userspace process reads a sensor file (like temp1_input) while this
delete function is running, could it race with the dev_set_drvdata(...,
NULL) call here and crash in ibmpex_show_sensor()?
Would it be safer to keep the original order where device_remove_file() is
called before clearing the driver data? device_remove_file() should wait
for any active sysfs callbacks to complete, which might already prevent the
use-after-free this patch intends to fix.
"
Revert the offending patch. If it can be shown that the originally reported
alleged race condition does indeed exist, it can always be re-introduced
with a complete fix.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 3ce9b7ae9d4d148672b35147aaf7987a4f82bb94 < 05112ba67c824ab416cd54307c0b50aba9f0047a | 05112ba67c824ab416cd54307c0b50aba9f0047a |
| linux | linux | >= 5.10.248 < 5.10.252 | 5.10.252 |
| linux | linux | >= 533ead425f8109b02fecc7e72d612b8898ec347a < efd68429f23fb4015b0ebc2392334059e06fad18 | efd68429f23fb4015b0ebc2392334059e06fad18 |
| linux | linux | >= 5aa2139201667c1f644601e4529c4acd6bf8db5a < 14a38784e09aebc21207dc32fffa05247fc3dd64 | 14a38784e09aebc21207dc32fffa05247fc3dd64 |
| linux | linux | >= 6.1.160 < 6.1.165 | 6.1.165 |
| linux | linux | >= 6.12.64 < 6.12.75 | 6.12.75 |
| linux | linux | >= 6.18.3 < 6.18.14 | 6.18.14 |
| linux | linux | >= 6.6.120 < 6.6.128 | 6.6.128 |
| linux | linux | >= 68d62e5bebbd118b763e8bb210d5cf2198ef450c < 914b47c9b824d3d74f31c764163edf93302100b1 | 914b47c9b824d3d74f31c764163edf93302100b1 |
| linux | linux | >= 6946c726c3f4c36f0f049e6f97e88c510b15f65d < 894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d | 894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d |
| linux | linux | >= 6946c726c3f4c36f0f049e6f97e88c510b15f65d < 8bde3e395a85017f12af2b0ba5c3684f5af9c006 | 8bde3e395a85017f12af2b0ba5c3684f5af9c006 |
| linux | linux | >= fa37adcf1d564ef58b9dfb01b6c36d35c5294bad < f448acd86835a650f9ea83460b9ca347d3aafba5 | f448acd86835a650f9ea83460b9ca347d3aafba5 |
| linux | linux_kernel | — | — |