CVE-2026-45914

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.

Jean Delvare points out that the patch does not completely

fix the reported problem, that it in fact introduces a

(new) race condition, and that it may actually not be needed in

the first place.

Various AI reviews agree. Specific and relevant AI feedback:

"

This reordering sets the driver data to NULL before removing the sensor

attributes in the loop below.

ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but

does not check if it is NULL before dereferencing it to access

data->sensors[].

If a userspace process reads a sensor file (like temp1_input) while this

delete function is running, could it race with the dev_set_drvdata(...,

NULL) call here and crash in ibmpex_show_sensor()?

Would it be safer to keep the original order where device_remove_file() is

called before c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References