CVE-2026-45914

A flaw was found in the Linux kernel's hwmon: ibmpex driver. A race condition exists where a userspace process reading a sensor file can attempt to access freed memory if it races with a device deletion operation. This use-after-free vulnerability could allow a local attacker to cause a system crash, leading to a Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact because exploitation is constrained to authenticated local users and is bounded to a kernel crash resulting in a denial of service, without granting arbitrary code execution or privilege escalation. The issue stems from uncoordinated sysfs attribute access during device unregistration in the IBM PowerExecutive hardware monitoring driver (ibmpex). Exploitation requires the host to have the specific hardware monitoring driver loaded and an attacker concurrently reading sysfs sensor nodes during device removal, an operational scenario rarely encountered in standard enterprise deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.