CVE-2026-64213 Details
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock. Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it. If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register. This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm. Add the missing lock to lm90_alert() to solve the problem.
A vulnerability has been identified in the Linux kernel's hardware monitoring (hwmon) driver for the lm90 sensor. The issue arises because the lm90_alert function, which operates in the smbus alert context, disables the hardware alert line without first acquiring the necessary lock. This creates a race condition with sysfs write operations that hold the lock, allowing the write operations to unintentionally overwrite the alert handler's modifications. As a result, the hardware alert line can be re-enabled while the alarm is still active, leading to an interrupt storm. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed by adding the missing lock to the lm90_alert function. Users should update to the latest version of the Linux kernel stable tree where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/873e919e3101063a7a75989510ccfc125a4391cf | kernel.org | Patch |
| https://git.kernel.org/stable/c/b0b66aae8a94c3663d47e4000b0e81b89ce32186 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bed1fc32e0eb653806fa98afcf55f9a311fc4ce2 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.3, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | New CVE Received | kernel.org |