CVE-2026-74552
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initialized. This can trigger a NULL pointer access since lm90_update_device() and with it lm90_update_alarms_locked() will be called. This call schedules report_work and lm90_report_alarms(), which passes the still-NULL data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer dereference. Fix the problem by only scheduling the report and alert workers data->hwmon_dev is set.
How to fix
- Linux Linux31ce62d36d859423dc39f9902f7c4c307b2e00e3, 4eed33c7db5c0c573928d28d8a2c003642c679b8, 70d9a71aa407044d70b50d356b6decf6659c4d56, 075fce376cf852db9293481edce07c181a9b1f46, f0b791a006512a48b6348494cb6960598fa99a58, aa9429edf9fc0e90d6f4da19ea4b5495a54ab117 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f6d0775119fb905fb02eafa98d575cf8ee792d46 ≤ v < 31ce62d36d859423dc39f9902f7c4c307b2e00e3, f6d0775119fb905fb02eafa98d575cf8ee792d46 ≤ v < 4eed33c7db5c0c573928d28d8a2c003642c679b8, f6d0775119fb905fb02eafa98d575cf8ee792d46 ≤ v < 70d9a71aa407044d70b50d356b6decf6659c4d56, f6d0775119fb905fb02eafa98d575cf8ee792d46 ≤ v < 075fce376cf852db9293481edce07c181a9b1f46, f6d0775119fb905fb02eafa98d575cf8ee792d46 ≤ v < f0b791a006512a48b6348494cb6960598fa99a58, f6d0775119fb905fb02eafa98d575cf8ee792d46 ≤ v < aa9429edf9fc0e90d6f4da19ea4b5495a54ab117, 6.0 | 31ce62d36d859423dc39f9902f7c4c307b2e00e3, 4eed33c7db5c0c573928d28d8a2c003642c679b8, 70d9a71aa407044d70b50d356b6decf6659c4d56, 075fce376cf852db9293481edce07c181a9b1f46, f0b791a006512a48b6348494cb6960598fa99a58, aa9429edf9fc0e90d6f4da19ea4b5495a54ab117 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.