Linux Kernel Vulnerability in hwmon Driver by Vendor

CVE-2026-74552

What is CVE-2026-74552?

The vulnerability in the Linux kernel's hwmon subsystem occurs when alarms are reported before the driver is fully initialized. Specifically, after the function devm_hwmon_device_register_with_info() is invoked, user space can access sysfs attributes even though the driver has not yet registered completely. This premature access can lead to a NULL pointer dereference when lm90_update_device() is invoked, resulting in a crash. To mitigate this issue, it is essential to ensure that alarm reporting and scheduling only occur after the hwmon_dev structure is properly initialized. This fix will prevent the system from attempting to access uninitialized pointers, thereby enhancing stability.

References