CVE-2026-64038

A flaw was found in the Linux kernel's hardware monitoring (hwmon) subsystem. A timing issue in the lm90 driver can cause the system to attempt to access freed memory during module cleanup. This use-after-free vulnerability could lead to system instability and a Denial of Service (DoS).

This vulnerability is classified as having a Moderate impact because it presents a local denial of service risk without compromising confidentiality or integrity, and it only affects systems equipped with LM90-compatible hardware monitoring sensors. Triggering the defect requires a specific timing race during driver teardown or device unbinding, which limits the blast radius to a system crash. Systems lacking the corresponding sensor hardware or running configurations where the module is not loaded remain unexposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.