Linux Kernel Temperature Driver Vulnerability in IIO Module

CVE-2026-64492

What is CVE-2026-64492?

A vulnerability exists in the Linux kernel's IIO temperature driver (tmp006) that results from improper management of device triggers. The tmp006_probe() function allocates a data-ready (DRDY) trigger using devm_iio_trigger_alloc() but fails to register it with the corresponding devm_iio_trigger_register() function. As a result, the driver lacks a .remove() callback, leading to a scenario where, upon module unloading, the allocated memory is freed while the trigger remains in the global list, creating a dangling reference. This mismanagement poses risks of resource leaks and potential stability issues in the kernel.

References