CVE-2026-98200 - Vulnerability Details

- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

nsensor->current_state is dynamically replaced as the sensor's state
changes. update_numeric_sensor_from_wobj() does this by freeing the
old string and installing a new one:

if (strcmp(trimmed, nsensor->current_state)) {
new_string = hp_wmi_strdup(dev, trimmed);
if (new_string) {
devm_kfree(dev, nsensor->current_state);
nsensor->current_state = new_string;
}
}

This function is only ever called from hp_wmi_update_info() while
state->lock is held, so the free-and-replace itself is properly
serialized against concurrent updates.

fungible_show(), however, reads the same pointer after the lock has
already been dropped:

err = hp_wmi_update_info(state, info);
if (err)
return err;

switch (prop) {
...
case HP_WMI_PROPERTY_CURRENT_STATE:
seq_printf(seqf, "%s\n", nsensor->current_state);
break;

hp_wmi_update_info() takes state->lock internally and releases it
before returning, so by the time fungible_show() dereferences
nsensor->current_state in seq_printf(), no lock is held. Two
processes reading a sensor's current_state debugfs entry at
overlapping times (or one reading it while another read of the same
sensor triggers a refresh) can race: one thread's seq_printf() can
be part-way through printing the string at the moment another
thread's call into update_numeric_sensor_from_wobj() frees it with
devm_kfree() and installs a new pointer, causing a use-after-free
read.

Take state->lock around the read in fungible_show() as well, so it
can never run concurrently with the free-and-replace in
update_numeric_sensor_from_wobj().

Published: 2026-10-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s hp‑wmi‑sensors hwmon driver contains a race that allows a use‑after‑free read when the sensor’s current state string is updated while another process reads the same pointer through seq_printf. This dereference of freed memory can crash the kernel, causing loss of availability and potential integrity violations. The flaw arises from missing synchronization around the read in fungible_show().

Affected Systems

All Linux kernel installations that include the hp‑wmi‑sensors driver in the hwmon subsystem are potentially affected. No specific kernel release is enumerated, and it is inferred that any kernel version containing this driver should be treated as vulnerable until the patch is applied.

Risk and Exploitability

The race created by missing synchronization can be exploited by concurrent debugfs accesses. With a CVSS score of 5.5, the vulnerability presents moderate risk. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to execute local or privileged code to coordinate simultaneous reads and updates, but the exact attack surface is not confirmed.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`23902f98f8d4811ab84dde6419569a5b374f8122`	affected	< b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795
`23902f98f8d4811ab84dde6419569a5b374f8122`	affected	< f59ecfd2c58bace39538f3fff7f43788b3fdb539
`23902f98f8d4811ab84dde6419569a5b374f8122`	affected	< 72c85149794a1ccf8d718ffed1521106b5d31968
`23902f98f8d4811ab84dde6419569a5b374f8122`	affected	< 9c1e65bc79ff104914b11e6ad972139296ec86fe
`23902f98f8d4811ab84dde6419569a5b374f8122`	affected	< e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[23902f98f8d4811ab84dde6419569a5b374f8122,b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795)`	affected	code_commit	—
`[23902f98f8d4811ab84dde6419569a5b374f8122,f59ecfd2c58bace39538f3fff7f43788b3fdb539)`	affected	code_commit	—
`[23902f98f8d4811ab84dde6419569a5b374f8122,72c85149794a1ccf8d718ffed1521106b5d31968)`	affected	code_commit	—
`[23902f98f8d4811ab84dde6419569a5b374f8122,9c1e65bc79ff104914b11e6ad972139296ec86fe)`	affected	code_commit	—
`[23902f98f8d4811ab84dde6419569a5b374f8122,e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.5`	affected	generic	—
`[0,6.5)`	unaffected	generic	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that contains the fix for hp‑wmi‑sensors
If a kernel upgrade is not immediately possible, unload or disable the hp‑wmi‑sensors module to eliminate the race condition
Restrict access to the hwmon debugfs entries that expose nsensor->current_state to prevent untrusted reads

Generated by OpenCVE AI on October 9, 2026 at 04:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98200.mbox
https://git.kernel.org/stable/c/72c85149794a1ccf8d718ffed1521106b5d31968
https://git.kernel.org/stable/c/9c1e65bc79ff104914b11e6ad972139296ec86fe
https://git.kernel.org/stable/c/b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795
https://git.kernel.org/stable/c/e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69
https://git.kernel.org/stable/c/f59ecfd2c58bace39538f3fff7f43788b3fdb539
https://nvd.nist.gov/vuln/detail/CVE-2026-98200
https://www.cve.org/CVERecord?id=CVE-2026-98200

History

Fri, 09 Oct 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Fri, 09 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98200.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98200 https://www.cve.org/CVERecord?id=CVE-2026-98200
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 07 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Tue, 06 Oct 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 06 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() nsensor->current_state is dynamically replaced as the sensor's state changes. update_numeric_sensor_from_wobj() does this by freeing the old string and installing a new one: if (strcmp(trimmed, nsensor->current_state)) { new_string = hp_wmi_strdup(dev, trimmed); if (new_string) { devm_kfree(dev, nsensor->current_state); nsensor->current_state = new_string; } } This function is only ever called from hp_wmi_update_info() while state->lock is held, so the free-and-replace itself is properly serialized against concurrent updates. fungible_show(), however, reads the same pointer after the lock has already been dropped: err = hp_wmi_update_info(state, info); if (err) return err; switch (prop) { ... case HP_WMI_PROPERTY_CURRENT_STATE: seq_printf(seqf, "%s\n", nsensor->current_state); break; hp_wmi_update_info() takes state->lock internally and releases it before returning, so by the time fungible_show() dereferences nsensor->current_state in seq_printf(), no lock is held. Two processes reading a sensor's current_state debugfs entry at overlapping times (or one reading it while another read of the same sensor triggers a refresh) can race: one thread's seq_printf() can be part-way through printing the string at the moment another thread's call into update_numeric_sensor_from_wobj() frees it with devm_kfree() and installs a new pointer, causing a use-after-free read. Take state->lock around the read in fungible_show() as well, so it can never run concurrently with the free-and-replace in update_numeric_sensor_from_wobj().
Title		hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/72c85149794a1ccf8d718ffed1521106b5d31968 https://git.kernel.org/stable/c/9c1e65bc79ff104914b11e6ad972139296ec86fe https://git.kernel.org/stable/c/b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795 https://git.kernel.org/stable/c/e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69 https://git.kernel.org/stable/c/f59ecfd2c58bace39538f3fff7f43788b3fdb539

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:38.289Z

Updated: 2026-10-19T09:15:31.295Z

Reserved: 2026-09-25T10:25:14.324Z

Link: CVE-2026-98200

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:05.747

Modified: 2026-10-19T10:18:20.623

Link: CVE-2026-98200

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98200 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T04:30:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object