CVE-2026-98198

A flaw was found in the Linux kernel's PWM fan driver. A local privileged user can cause a Denial of Service (DoS) or memory corruption by unbinding or detaching the driver. Due to an improper cleanup sequence, internal data structures are released while the sampling timer is still active, resulting in a use-after-free condition when the timer expires.

A moderate-severity use-after-free flaw was found in the Linux kernel's PWM fan (hwmon pwm-fan) driver, affecting the Red Hat Enterprise Linux 9 and 10 kernels, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9. The devres cleanup action that stops the RPM sampling timer is registered before the tachometer data arrays it protects are allocated; because devres releases resources in reverse registration order, unbinding or detaching the driver can free the ctx->tachs and ctx->pulses_per_revolution arrays while the self-rearming sample_timer() callback is still pending. A timer expiry in that window reads from and writes to the freed memory, which can result in kernel memory corruption or a crash and therefore a local denial of service. Exploitation requires local access with administrative privileges to initiate the driver unbind or detach and depends on winning a narrow timing race during teardown, which limits the practical risk. Red Hat Enterprise Linux 6, 7, and 8 (including kernel-rt) and OpenShift Container Platform releases built on RHEL CoreOS 8 are not affected because the vulnerable code is not present in those kernels. The fix is deferred to future planned kernel updates because the flaw is only triggerable by a privileged local user during driver teardown; the residual risk is a local kernel crash or memory corruption on systems using the pwm-fan driver with tachometer sampling enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.