A concurrency race exists in the Linux kernel's lm90 hwmon driver where the alert handler runs without acquiring the hwmon_lock. During an alert, lm90_update_confreg disables the hardware alert line, but if a sysfs write holds the lock at the same time, the write can overwrite the handler’s changes and re‑enable the alert line. The result is an interrupt storm that can overwhelm the kernel, causing a denial of service. This flaw maps to CWE‑820, a data race, and is further classified as NVD-CWE-noinfo in the NVD database.

Any Linux distribution that uses the lm90 driver in its kernel is affected. The vulnerability is present in kernel versions before the patch that adds lock protection to lm90_alert; systems that have not applied the relevant commit are at risk.

Based on the description, it is inferred that the attacker would need local access and the ability to trigger a concurrent sysfs write and SMBus alert. EPSS indicates a probability of less than 1%, and the flaw is not listed in CISA’s KEV catalog, implying a low likelihood of widespread attacks. Nevertheless, if such conditions are met, the race condition could lead to a denial-of-service.