{"schema":"threatline.record/2","record":{"id":"CVE-2026-98200","aliases":[],"summary":"hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()\n\nnsensor->current_state is dynamically replaced as the sensor's state\nchanges. update_numeric_sensor_from_wobj() does this by freeing the\nold string and installing a new one:\n\n\tif (strcmp(trimmed, nsensor->current_state)) {\n\t\tnew_string = hp_wmi_strdup(dev, trimmed);\n\t\tif (new_string) {\n\t\t\tdevm_kfree(dev, nsensor->current_state);\n\t\t\tnsensor->current_state = new_string;\n\t\t}\n\t}\n\nThis function is only ever called from hp_wmi_update_info() while\nstate->lock is held, so the free-and-replace itself is properly\nserialized against concurrent updates.\n\nfungible_show(), however, reads the same pointer after the lock has\nalready been dropped:\n\n\terr = hp_wmi_update_info(state, info);\n\tif (err)\n\t\treturn err;\n\n\tswitch (prop) {\n\t...\n\tcase HP_WMI_PROPERTY_CURRENT_STATE:\n\t\tseq_printf(seqf, \"%s\\n\", nsensor->current_state);\n\t\tbreak;\n\nhp_wmi_update_info() takes state->lock internally and releases it\nbefore returning, so by the time fungible_show() dereferences\nnsensor->current_state in seq_printf(), no lock is held. Two\nprocesses reading a sensor's current_state debugfs entry at\noverlapping times (or one reading it while another read of the same\nsensor triggers a refresh) can race: one thread's seq_printf() can\nbe part-way through printing the string at the moment another\nthread's call into update_numeric_sensor_from_wobj() frees it with\ndevm_kfree() and installs a new pointer, causing a use-after-free\nread.\n\nTake state->lock around the read in fungible_show() as well, so it\ncan never run concurrently with the free-and-replace in\nupdate_numeric_sensor_from_wobj().","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98200","source_modified_at":"2026-10-19T09:15:31.295Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795","status":"affected","versionType":"git"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"f59ecfd2c58bace39538f3fff7f43788b3fdb539","status":"affected","versionType":"git"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"72c85149794a1ccf8d718ffed1521106b5d31968","status":"affected","versionType":"git"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"9c1e65bc79ff104914b11e6ad972139296ec86fe","status":"affected","versionType":"git"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98200","source_modified_at":"2026-10-19T09:15:31.295Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98200","source_modified_at":"2026-10-19T09:15:31.295Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"72c85149794a1ccf8d718ffed1521106b5d31968","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98200","source_modified_at":"2026-10-19T09:15:31.295Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"9c1e65bc79ff104914b11e6ad972139296ec86fe","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00175,"percentile":0.06673,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:44:38.289Z","modified_at":"2026-10-19T09:15:31.295Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98200","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:15:31.295Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98200","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/f59ecfd2c58bace39538f3fff7f43788b3fdb539"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/72c85149794a1ccf8d718ffed1521106b5d31968"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9c1e65bc79ff104914b11e6ad972139296ec86fe"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:15:31.295Z","content_hash":"9483082bb6f797383e3ce0a5c06ab4526b35f05addccda8f94a4e51fb9a37d74"}}