CVE-2026-97582

A flaw was found in the Linux kernel's GPIO fan driver. When a device is unbound, pending alarm work is not properly canceled before associated memory resources are freed, resulting in a use-after-free condition. A local attacker could exploit this race condition to cause a Denial of Service (DoS) through a kernel crash or potentially achieve arbitrary code execution.

A flaw was found in the Linux kernel's GPIO fan (gpio-fan) hwmon driver. fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels that work when the device is unbound; devres cleanup frees the interrupt (which only waits for the handler itself) and then releases the hwmon device and fan_data, so a still-pending fan_alarm_notify() can run after those frees and dereference already-freed memory. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): a local attacker would need access to the affected host, the ability to trigger a device unbind, and to win the resulting race window, most plausibly crashing the kernel and causing a denial of service; arbitrary code execution is considered possible but has not been demonstrated.

Red Hat Enterprise Linux 10 (kernel) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components) contain the vulnerable code and are marked affected with the fix deferred to a later update; while the fix is pending, the residual risk is limited because exploitation requires local access, privileges over device lifecycle operations, and winning a narrow race, with impact primarily on availability. Red Hat Enterprise Linux 6, 7, 8, and 9, including their Real Time kernel variants, and the OpenShift Container Platform RHEL CoreOS 8 and RHEL CoreOS 9 based images are not affected because the vulnerable code is not present in those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.