Cloudanix VulnDB

CVE-2026-98200

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how certain HP hardware sensors are read on Linux can let one process free memory that another process is still using, which may crash the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free read of a dynamically allocated string pointer (nsensor->current_state) in the fungible_show() debugfs handler after the protecting state->lock has been released by hp_wmi_update_info(), allowing a concurrent update_numeric_sensor_from_wobj() call to devm_kfree the old string while it is still being dereferenced in seq_printf().

Why it matters to the business

Systems running the affected hp-wmi-sensors driver may experience kernel instability, crashes, or memory corruption when multiple processes access the same sensor debugfs entry concurrently, potentially disrupting monitoring and requiring reboots on HP hardware.

How an attack unfolds

An attacker with local access triggers repeated reads of a sensor's current_state debugfs file while sensor state updates occur; the race between the unlocked pointer read in fungible_show() and the free-and-replace inside the locked update path produces the use-after-free.

How to fix it

Apply the upstream fix that acquires state->lock around the read of nsensor->current_state inside fungible_show(); rebuild and deploy the patched kernel module or upgrade to a kernel containing the resolution.

How to confirm the fix worked

Confirm the lock acquisition now surrounds the seq_printf call for HP_WMI_PROPERTY_CURRENT_STATE in fungible_show(); verify with code review or by running concurrent debugfs reads under stress while monitoring for UAF reports in the kernel log.

Typical attack path

  1. Obtain local shell or userland access on a Linux system using the hp-wmi-sensors driver.
  2. Locate the relevant debugfs sensor entry for a numeric sensor exposing HP_WMI_PROPERTY_CURRENT_STATE.
  3. Spawn concurrent processes that repeatedly read the debugfs file while sensor values are refreshed via hp_wmi_update_info().
  4. Trigger the race condition that causes one thread's seq_printf to dereference a freed string pointer.

How to detect it

Inspect kernel logs for use-after-free or slab-out-of-bounds warnings mentioning hp-wmi-sensors or fungible_show; correlate with processes accessing /sys/kernel/debug/ entries under hp-wmi-sensors while sensor updates are active.

What your security team should do

  • Prioritize patching the hp-wmi-sensors driver on all HP Linux systems within the next maintenance window.
  • Restrict debugfs access to privileged users only until the fix is deployed.
  • Monitor kernel logs for use-after-free warnings related to hp_wmi_sensors.
  • Test the patched kernel under concurrent sensor read workloads before broad rollout.

The record

In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() nsensor->current_state is dynamically replaced as the sensor's state changes. update_numeric_sensor_from_wobj() does this by freeing the old string and installing a new one: if (strcmp(trimmed, nsensor->current_state)) { new_string = hp_wmi_strdup(dev, trimmed); if (new_string) { devm_kfree(dev, nsensor->current_state); nsensor->current_state = new_string; } } This function is only ever called from hp_wmi_update_info() while state->lock is held, so the free-and-replace itself is properly serialized against concurrent updates. fungible_show(), however, reads the same pointer after the lock has already been dropped: err = hp_wmi_update_info(state, info); if (err) return err; switch (prop) { ... case HP_WMI_PROPERTY_CURRENT_STATE: seq_printf(seqf, "%s\n", nsensor->current_state); break; hp_wmi_update_info() takes state->lock internally and releases it before returning, so by the time fungible_show() dereferences nsensor->current_state in seq_printf(), no lock is held. Two processes reading a sensor's current_state debugfs entry at overlapping times (or one reading it while another read of the same sensor triggers a refresh) can race: one thread's seq_printf() can be part-way through printing the string at the moment another thread's call into update_numeric_sensor_from_wobj() frees it with devm_kfree() and installs a new pointer, causing a use-after-free read. Take state->lock around the read in fungible_show() as well, so it can never run concurrently with the free-and-replace in update_numeric_sensor_from_wobj().

Affected packages

Ecosystem Package Introduced Fixed