CVE-2026-98000

A flaw was found in the Linux kernel's Hardware Monitoring (hwmon) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) or potentially corrupt memory by triggering a use-after-free (UAF) condition. When an error occurs during a device write operation, the kernel releases the device prematurely, causing it to access and unlock an already-freed lock during cleanup.

A Moderate severity use-after-free flaw was found in the Linux kernel's hardware monitoring (hwmon) subsystem. In pec_store(), a guard(mutex) is taken on the hwmon device lock; when the underlying chip write operation fails with an error other than -EOPNOTSUPP, the error path calls put_device(), which can drop the final reference and free the device while the mutex guard is still in scope. When the function then returns, the guard cleanup attempts to unlock the already-freed mutex. A local user with the privileges required to write to the hwmon PEC sysfs attribute, and who can trigger a chip write error under the necessary device reference-lifetime conditions, could use this flaw to crash the kernel (denial of service) or potentially corrupt kernel memory. Red Hat Enterprise Linux 10 (rhel-10.2, rhel-10.3, rhel-10.4) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, with fixes currently deferred for those streams; the residual risk of the deferral is considered limited because exploitation requires privileged local access and depends on specific error and reference-counting conditions, so the practical impact is local denial of service. RHEL 7, 8, and 9 kernels, kernel-rt, and OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code, introduced upstream in kernel 6.18 by the hwmon serialization change, is not present in those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.