CVE-2026-90311
NoneCVSS
—
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel's handling of temperature sensors can freeze the machine when certain hardware monitoring drivers are removed or updated.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in thermal hwmon sysfs registration and removal allows a thermal zone removal to stall indefinitely when the hwmon class device holds attributes belonging to other zones of the same type, because thermal_remove_hwmon_sysfs skips deletion under the thermal_hwmon_list_lock.
Why it matters to the business
Systems may become unresponsive or require reboot when thermal drivers are unbound or thermal zones are removed, disrupting temperature-based power management and hardware monitoring on affected Linux kernels.
How an attack unfolds
An attacker with local access triggers repeated bind/unbind operations on platform thermal drivers or manipulates ACPI thermal zones of identical type to race the hwmon device teardown path, causing the removal operation to block and hang the system.
How to fix it
Update to a kernel containing the referenced commit that performs full hwmon class device removal under thermal_hwmon_list_lock and adjusts label layout in thermal_add_hwmon_sysfs; rebuild and deploy the updated kernel across all affected distributions.
How to confirm the fix worked
After patching, verify that unbinding the ACPI thermal driver cleanly removes the hwmon class device and all associated temp*_input attributes without stalling; inspect dmesg and /sys/class/hwmon for absence of orphaned entries.
Typical attack path
- Obtain local execution or driver control on the target system
- Identify or create multiple thermal zones sharing the same type string
- Trigger unbind or removal of the thermal zone that owns the hwmon class device
- Exploit the window where temp*_input attributes from remaining zones prevent hwmon deletion
- Observe or force the resulting kernel hang during thermal_remove_hwmon_sysfs
How to detect it
Search kernel logs for stalled thermal_remove_hwmon_sysfs calls or hung tasks involving thermal_hwmon_list_lock during driver unbind; examine sysfs for orphaned hwmon directories after zone removal attempts.
What your security team should do
- Prioritize kernel updates on systems exposing ACPI or virtual thermal zones
- Monitor for stalled thermal zone removal tasks in production workloads
- Test driver unload sequences in staging environments before broad rollout
- Track EPSS and exploit maturity indicators for any future public PoCs
The record
In the Linux kernel, the following vulnerability has been resolved: thermal: hwmon: Remove hwmon class device along with its parent The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type. That turns out to be problematic when the thermal zone holding the hwmon device is removed. For example, say that there are two ACPI thermal zones on a system /sys/devices/virtual/thermal/thermal_zone0/ /sys/devices/virtual/thermal/thermal_zone1/ The current code registers a hwmon class device for thermal_zone0 only: /sys/devices/virtual/thermal/thermal_zone0/hwmon0/ because the type is "acpitz" for both of them, but it adds a sysfs attribute that belongs to thermal_zone1 under it: /sys/devices/virtual/thermal/thermal_zone0/hwmon0/temp2_input There is also /sys/devices/virtual/thermal/thermal_zone0/hwmon0/temp1_input which belongs to thermal_zone0. When thermal_zone0 is removed, say because the ACPI thermal driver is unbound from the underlying platform device, thermal_remove_hwmon_sysfs() skips the removal of hwmon0 because of the temp2_input attribute belonging to thermal_zone1 which effectively prevents thermal_zone0 removal from making progress. Address this by making thermal_remove_hwmon_sysfs() remove the entire hwmon class device interface for the given thermal zone type when the thermal zone device holding it is removed. To prevent races with thermal_add_hwmon_sysfs() that may interfere with this, carry out the entire addition and removal of hwmon sysfs interfaces for thermal zones under thermal_hwmon_list_lock. Also adjust the layout of the labels in thermal_add_hwmon_sysfs() to the current kernel coding style to align with the new "unlock" label.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|