CVE-2026-45914 - Vulnerability Details

- Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

Description

In the Linux kernel, the following vulnerability has been resolved:

Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.

Jean Delvare points out that the patch does not completely
fix the reported problem, that it in fact introduces a
(new) race condition, and that it may actually not be needed in
the first place.

Various AI reviews agree. Specific and relevant AI feedback:

"
This reordering sets the driver data to NULL before removing the sensor
attributes in the loop below.

ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but
does not check if it is NULL before dereferencing it to access
data->sensors[].

If a userspace process reads a sensor file (like temp1_input) while this
delete function is running, could it race with the dev_set_drvdata(...,
NULL) call here and crash in ibmpex_show_sensor()?

Would it be safer to keep the original order where device_remove_file() is
called before clearing the driver data? device_remove_file() should wait
for any active sysfs callbacks to complete, which might already prevent the
use-after-free this patch intends to fix.
"

Revert the offending patch. If it can be shown that the originally reported
alleged race condition does indeed exist, it can always be re-introduced
with a complete fix.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The IBM PEX hardware monitoring driver in the Linux kernel contains a race condition that can lead to a null pointer dereference. When a userspace process reads a sensor file at the same time the driver is being unloaded, the driver data is cleared to NULL before the sysfs callback finishes, causing the kernel to crash. This results in a denial‑of‑service affecting the entire system.

Affected Systems

All Linux kernel builds that include the ibmpex driver are potentially impacted. No specific vendor version is listed, and the issue is present wherever the driver is compiled into the kernel.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need local access or privileged users to trigger the race condition, for example by repeatedly reading sensor files while the driver is being removed. Successful exploitation would result in a kernel crash and a system‑wide denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3ce9b7ae9d4d148672b35147aaf7987a4f82bb94`	affected	< 05112ba67c824ab416cd54307c0b50aba9f0047a
`533ead425f8109b02fecc7e72d612b8898ec347a`	affected	< efd68429f23fb4015b0ebc2392334059e06fad18
`fa37adcf1d564ef58b9dfb01b6c36d35c5294bad`	affected	< f448acd86835a650f9ea83460b9ca347d3aafba5
`68d62e5bebbd118b763e8bb210d5cf2198ef450c`	affected	< 914b47c9b824d3d74f31c764163edf93302100b1
`5aa2139201667c1f644601e4529c4acd6bf8db5a`	affected	< 14a38784e09aebc21207dc32fffa05247fc3dd64
`6946c726c3f4c36f0f049e6f97e88c510b15f65d`	affected	< 894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d
`6946c726c3f4c36f0f049e6f97e88c510b15f65d`	affected	< 8bde3e395a85017f12af2b0ba5c3684f5af9c006
`5.10.248`	affected	< 5.10.252
`6.1.160`	affected	< 6.1.165
`6.6.120`	affected	< 6.6.128
`6.12.64`	affected	< 6.12.75
`6.18.3`	affected	< 6.18.14

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`5.10.252`	unaffected	≤ 5.10.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.14`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3ce9b7ae9d4d148672b35147aaf7987a4f82bb94,05112ba67c824ab416cd54307c0b50aba9f0047a)`	affected	code_commit	—
`[533ead425f8109b02fecc7e72d612b8898ec347a,efd68429f23fb4015b0ebc2392334059e06fad18)`	affected	code_commit	—
`[fa37adcf1d564ef58b9dfb01b6c36d35c5294bad,f448acd86835a650f9ea83460b9ca347d3aafba5)`	affected	code_commit	—
`[68d62e5bebbd118b763e8bb210d5cf2198ef450c,914b47c9b824d3d74f31c764163edf93302100b1)`	affected	code_commit	—
`[5aa2139201667c1f644601e4529c4acd6bf8db5a,14a38784e09aebc21207dc32fffa05247fc3dd64)`	affected	code_commit	—
`[6946c726c3f4c36f0f049e6f97e88c510b15f65d,894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d)`	affected	code_commit	—
`[6946c726c3f4c36f0f049e6f97e88c510b15f65d,8bde3e395a85017f12af2b0ba5c3684f5af9c006)`	affected	code_commit	—
`[5.10.248,5.10.252)`	affected	semver	—
`[6.1.160,6.1.165)`	affected	semver	—
`[6.6.120,6.6.128)`	affected	semver	—
`[6.12.64,6.12.75)`	affected	semver	—
`[6.18.3,6.18.14)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.19`	affected	semver	—
`[0,6.19)`	unaffected	semver	—
`[5.10.252,5.10.*]`	unaffected	generic	—
`[6.1.165,6.1.*]`	unaffected	generic	—
`[6.6.128,6.6.*]`	unaffected	generic	—
`[6.12.75,6.12.*]`	unaffected	generic	—
`[6.18.14,6.18.*]`	unaffected	generic	—
`[6.19.4,6.19.*]`	unaffected	generic	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that reverts the offending patch and restores correct driver behavior.
If an update cannot be applied immediately, unload or blacklist the ibmpex kernel module so that the sensor files are not exposed and no userspace process can read them during removal.
As a temporary measure, restrict or remove read permissions on the relevant sysfs entries (e.g., temp*_input) to prevent accidental access while the driver is being unloaded.

Generated by OpenCVE AI on May 28, 2026 at 17:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a
https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64
https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d
https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006
https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1
https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18
https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5
https://lore.kernel.org/linux-cve-announce/2026052723-CVE-2026-45914-eaae@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45914
https://www.cve.org/CVERecord?id=CVE-2026-45914

History

Thu, 28 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-476

Thu, 28 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026052723-CVE-2026-45914-eaae@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45914 https://www.cve.org/CVERecord?id=CVE-2026-45914
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-476

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Revert "hwmon: (ibmpex) fix use-after-free in high/low store" This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d. Jean Delvare points out that the patch does not completely fix the reported problem, that it in fact introduces a (new) race condition, and that it may actually not be needed in the first place. Various AI reviews agree. Specific and relevant AI feedback: " This reordering sets the driver data to NULL before removing the sensor attributes in the loop below. ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but does not check if it is NULL before dereferencing it to access data->sensors[]. If a userspace process reads a sensor file (like temp1_input) while this delete function is running, could it race with the dev_set_drvdata(..., NULL) call here and crash in ibmpex_show_sensor()? Would it be safer to keep the original order where device_remove_file() is called before clearing the driver data? device_remove_file() should wait for any active sysfs callbacks to complete, which might already prevent the use-after-free this patch intends to fix. " Revert the offending patch. If it can be shown that the originally reported alleged race condition does indeed exist, it can always be re-introduced with a complete fix.
Title		Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64 https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006 https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1 https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18 https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:17:29.426Z

Updated: 2026-05-27T12:17:29.426Z

Reserved: 2026-05-13T15:03:33.085Z

Link: CVE-2026-45914

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:06.180

Modified: 2026-06-17T10:52:43.323

Link: CVE-2026-45914

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45914 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T17:30:15Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object