The vulnerability arises when userspace reads the Linux kernel’s lm90 hardware monitoring driver sysfs attributes before the driver has finished registering. At this moment the hwmon_dev pointer is NULL and the alarm reporting logic dereferences it, resulting in a kernel null pointer exception that can cause the kernel to panic or crash. This is a classic NULL pointer dereference and involves a race condition where the driver’s readiness is not yet set, representing CWE-824. The flaw is a privileged code error that can lead to system instability.

The flaw affects the Linux kernel’s lm90 hardware monitoring driver. All kernel configurations that include the lm90 module are potentially vulnerable. No specific kernel version range is listed, so any deployment using the lm90 driver could be impacted.

Based on the description, it is inferred that the attack vector involves a local user or process reading the lm90 sysfs attributes before the driver has fully initialized. The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. This scenario could occur early during system boot or if driver enumeration is delayed. While the impact is a kernel crash that results in denial of service, the low EPSS indicates exploitation is unlikely in the wild.