CVE-2026-98198
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 01695410d4529e38fea6159fa9f1260c598290b0, < 1e824fdb14a187ce56697e803b02b1e86243a755Upgrade to: 1e824fdb14a187ce56697e803b02b1e86243a755Affected: ≥ 01695410d4529e38fea6159fa9f1260c598290b0, < a5ce3fe5335a24d0220958c6866830a6d5fa1cc0Upgrade to: a5ce3fe5335a24d0220958c6866830a6d5fa1cc0Affected: ≥ 01695410d4529e38fea6159fa9f1260c598290b0, < b48339b0a577783e4590a69e4cd2f2760ce33154Upgrade to: b48339b0a577783e4590a69e4cd2f2760ce33154Affected: ≥ 01695410d4529e38fea6159fa9f1260c598290b0, < 26d5ff79768548efb1e604bb6e8697c101e06269Upgrade to: 26d5ff79768548efb1e604bb6e8697c101e06269Stated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pwm-fan) Stop RPM timer before freeing tach data sample_timer() rearms the RPM timer and accesses the devm-managed ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action which stops the timer is registered before those arrays are allocated. Since devres releases entries in reverse order, driver detach can free the arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry in that window accesses the freed tach data. With a KASAN kernel, a test-only kprobe delayed entry to pwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs reported three four-byte reads and two four-byte writes in sample_timer() after its backing devm allocations had been freed. The helper did not invoke the timer callback, cleanup actions or free functions. With the fix, three matching unbind runs completed without KASAN, BUG, WARNING, Oops or panic. Instrumentation confirmed that timer retirement completed before the first timer backing allocation was released. Split timer retirement from the power cleanup and register its devres action after the timer backing data and IRQ actions are installed. This preserves the early power rollback action while ensuring the timer is retired before its backing data is released. Use timer_shutdown_sync() because the callback can rearm itself.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/1e824fdb14a187ce56697e803b02b1e86243a755
- git.kernel.org/stable/c/a5ce3fe5335a24d0220958c6866830a6d5fa1cc0
- git.kernel.org/stable/c/b48339b0a577783e4590a69e4cd2f2760ce33154
And 1 more reference. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI