CVE-2026-23186

hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()

View on CVE.org
Published Feb 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()

The acpi_power_meter driver's .notify() callback function,
acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock
that is also acquired by callbacks in sysfs attributes of the device
being unregistered which is prone to deadlocks between sysfs access and
device removal.

Address this by moving the hwmon device removal in
acpi_power_meter_notify() outside the lock in question, but notice
that doing it alone is not sufficient because two concurrent
METER_NOTIFY_CONFIG notifications may be attempting to remove the
same device at the same time. To prevent that from happening, add a
new lock serializing the execution of the switch () statement in
acpi_power_meter_notify(). For simplicity, it is a static mutex
which should not be a problem from the performance perspective.

The new lock also allows the hwmon_device_register_with_info()
in acpi_power_meter_notify() to be called outside the inner lock
because it prevents the other notifications handled by that function
from manipulating the "resource" object while the hwmon device based
on it is being registered. The sending of ACPI netlink messages from
acpi_power_meter_notify() is serialized by the new lock too which
generally helps to ensure that the order of handling firmware
notifications is the same as the order of sending netlink messages
related to them.

In addition, notice that hwmon_device_register_with_info() may fail
in which case resource->hwmon_dev will become an error pointer,
so add checks to avoid attempting to unregister the hwmon device
pointer to by it in that case to acpi_power_meter_notify() and
acpi_power_meter_remove().

Analysis

AI-generated

Technical impact

The vulnerability exists in the Linux kernel's hwmon acpi_power_meter driver, where its notify callback registers and unregisters hwmon devices while holding a lock that sysfs attribute callbacks also acquire. This overlap can lead to deadlocks between sysfs access and device removal. The resulting race condition can stall the kernel, causing service interruption or system hang. The fix removes the unregister from the lock and introduces a dedicated mutex to serialize concurrent notifications, preventing the deadlock and ensuring sysfs operations remain responsive.

Affected Systems

The issue affects Linux kernel builds that include the acpi_power_meter driver prior to the applied patch. Affected builds include all 6.19 release candidates from rc1 through rc8 and other Linux kernel releases that have not yet incorporated the commits mentioned in the references. Any system running a kernel version older than the patched code is potentially susceptible.

Risk and Exploitability

The CVSS score of 5.5 classifies the vulnerability as medium severity. However, the EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves triggering ACPI power meter notifications or performing sysfs attribute access during device removal, which could be leveraged by a local or possibly remote attacker with capabilities to influence ACPI events. In practice, the risk is moderate to low, primarily affecting systems with exposed ACPI interfaces and lacking the patch.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the fixed commits for acpi_power_meter_notify().
  • If an immediate kernel upgrade is not possible, temporarily disable the acpi_power_meter driver or its notifications by passing appropriate boot parameters or unbinding the device.
  • Monitor system logs and sysfs activity for signs of deadlock or service stalls until a patch can be applied.

Generated by OpenCVE AI on April 17, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-667
CPEs cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() The acpi_power_meter driver's .notify() callback function, acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock that is also acquired by callbacks in sysfs attributes of the device being unregistered which is prone to deadlocks between sysfs access and device removal. Address this by moving the hwmon device removal in acpi_power_meter_notify() outside the lock in question, but notice that doing it alone is not sufficient because two concurrent METER_NOTIFY_CONFIG notifications may be attempting to remove the same device at the same time. To prevent that from happening, add a new lock serializing the execution of the switch () statement in acpi_power_meter_notify(). For simplicity, it is a static mutex which should not be a problem from the performance perspective. The new lock also allows the hwmon_device_register_with_info() in acpi_power_meter_notify() to be called outside the inner lock because it prevents the other notifications handled by that function from manipulating the "resource" object while the hwmon device based on it is being registered. The sending of ACPI netlink messages from acpi_power_meter_notify() is serialized by the new lock too which generally helps to ensure that the order of handling firmware notifications is the same as the order of sending netlink messages related to them. In addition, notice that hwmon_device_register_with_info() may fail in which case resource->hwmon_dev will become an error pointer, so add checks to avoid attempting to unregister the hwmon device pointer to by it in that case to acpi_power_meter_notify() and acpi_power_meter_remove().
Title hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Linux
Published
Updated
Nov 5, 2026, 9:23 PM
Reserved
Jan 13, 2026, 3:37 PM

View source JSON

Updated
Nov 5, 2026, 9:21 PM

JSON

Status
Analyzed
Published
Feb 14, 2026, 5:15 PM
Modified
Nov 5, 2026, 10:18 PM

View source JSON

Severity
Moderate
Public date
Feb 14, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Apr 17, 2026, 7:30 PM

JSON