CVE-2026-98197

What it actually does

Use-after-free in the w83791d hwmon driver where optional fan/pwm 4-5 sysfs entries created during probe are not removed on normal driver unbind, allowing callbacks to access devm-freed driver data.

Why it matters to the business

On systems using the w83791d sensor chip, unloading the driver can leave behind sysfs files that later trigger crashes or memory corruption when accessed, leading to instability during driver reloads or hardware reconfiguration.

How an attack unfolds

An attacker with local access to affected hardware triggers driver unbind (via sysfs or module unload) then reads or writes the stale fan/pwm 4-5 sysfs attributes; the callbacks dereference freed driver structures resulting in a use-after-free.

How to fix it

Apply the upstream fix that removes w83791d_group_fanpwm45 during normal driver teardown; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the remove path in the w83791d driver source to ensure both sysfs groups are removed, and test probe/remove cycles on w83791d hardware to verify no orphaned attributes remain.

Typical attack path

1. Identify presence of w83791d I2C device and load the driver
2. Trigger driver unbind through device removal or module unload
3. Access the orphaned fan/pwm 4-5 sysfs files before the device is rebound
4. Trigger use-after-free via read/write operations on the stale entries

How to detect it

Review kernel logs for oops or use-after-free warnings referencing w83791d during module unload; inspect sysfs under the I2C client device for lingering fanpwm45 attributes after driver unbind.

What your security team should do

• Prioritize patching systems that expose the w83791d driver in production hardware monitoring setups
• Audit kernel configurations for unnecessary sensor drivers and disable them where possible
• Monitor for future hwmon driver fixes in the same subsystem