CVE-2026-98000
Linux: hwmon: Fix potential UAF in pec_store
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8afab57bcdbc2186f325972e777880ac5a220f4fAlso 01dd8b4fc2cf83c66565c0f382fb1841e9000a89, 354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2CVE List
What fixes it
- 8afab57bcdbc2186f325972e777880ac5a220f4fLinuxCVE List
- 01dd8b4fc2cf83c66565c0f382fb1841e9000a89LinuxCVE List
- 354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: Fix potential UAF in pec_store
Sashiko reports:
In pec_store(), a guard(mutex)(&hwdev->lock) is taken. If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls put_device(hdev). If this drops the final reference, the device is freed. When the function then returns, the guard cleanup function runs and attempts to unlock the freed mutex.
Use scoped_guard() instead of guard() to avoid the problem.
Text from CVE List
Affected versions 8
- Linuxaffected: 3ad2a7b9b15d5072139a20be84adb36776eb6c9b before 8afab57bcdbc2186f325972e777880ac5a220f4fCVE List
- Linuxaffected: 3ad2a7b9b15d5072139a20be84adb36776eb6c9b before 01dd8b4fc2cf83c66565c0f382fb1841e9000a89CVE List
- Linuxaffected: 3ad2a7b9b15d5072139a20be84adb36776eb6c9b before 354ccc99b2dc8ba0cf6d4de34e520bcf6ecca5c2CVE List
- Linuxaffected: 6.18CVE List
- Linuxunaffected: all versions before 6.18CVE List
- Linuxunaffected: 6.18.53 through 6.18.*CVE List
- Linuxunaffected: 7.2.7 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List