Cloudanix VulnDB

CVE-2026-98198

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in a fan-speed monitoring driver could let the kernel read memory that had already been released, potentially causing crashes on affected machines.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in pwm-fan driver where sample_timer() can access devm-managed tach and pulses_per_revolution arrays after devres has released them because timer cleanup was registered before the arrays.

Why it matters to the business

Kernel panic or memory corruption on systems using pwm-fan hardware monitoring during driver unbind or module unload; low exploitability and no known in-the-wild use keep operational risk modest for most environments.

How an attack unfolds

An attacker with local access triggers repeated sysfs unbind operations while a delayed kprobe or race keeps the RPM timer armed; the timer callback then reads and writes the already-freed arrays, causing KASAN-detected corruption or a crash.

How to fix it

Upgrade to a kernel containing the fix that registers timer retirement after tach data allocation and uses timer_shutdown_sync(); apply the stable or distribution backport when available.

How to confirm the fix worked

Confirm the patch is present by inspecting hwmon/pwm-fan.c for the reordered devres actions and timer_shutdown_sync() call; re-run the original KASAN unbind test to verify no use-after-free reports.

Typical attack path

  1. Obtain local code execution or shell on the target host
  2. Locate pwm-fan sysfs entries and repeatedly unbind the driver
  3. Race or delay pwm_fan_cleanup() so the timer fires after its backing arrays are freed
  4. Trigger kernel oops, panic, or memory corruption

How to detect it

Look in kernel logs for KASAN reports, BUG, WARNING, Oops, or panic messages referencing sample_timer or pwm_fan_cleanup during driver unbind; no network or user-space artifacts are expected.

What your security team should do

  • Prioritize patching on systems that expose pwm-fan via sysfs or that run with KASAN or similar debug kernels
  • Monitor vendor or distribution advisories for the exact backported commit
  • Limit unprivileged access to hwmon sysfs interfaces until fixed

The record

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pwm-fan) Stop RPM timer before freeing tach data sample_timer() rearms the RPM timer and accesses the devm-managed ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action which stops the timer is registered before those arrays are allocated. Since devres releases entries in reverse order, driver detach can free the arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry in that window accesses the freed tach data. With a KASAN kernel, a test-only kprobe delayed entry to pwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs reported three four-byte reads and two four-byte writes in sample_timer() after its backing devm allocations had been freed. The helper did not invoke the timer callback, cleanup actions or free functions. With the fix, three matching unbind runs completed without KASAN, BUG, WARNING, Oops or panic. Instrumentation confirmed that timer retirement completed before the first timer backing allocation was released. Split timer retirement from the power cleanup and register its devres action after the timer backing data and IRQ actions are installed. This preserves the early power rollback action while ensuring the timer is retired before its backing data is released. Use timer_shutdown_sync() because the callback can rearm itself.

Affected packages

Ecosystem Package Introduced Fixed