CVE-2026-98200

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

nsensor->current_state is dynamically replaced as the sensor's state

changes. update_numeric_sensor_from_wobj() does this by freeing the

old string and installing a new one:

if (strcmp(trimmed, nsensor->current_state)) {

new_string = hp_wmi_strdup(dev, trimmed);

if (new_string) {

devm_kfree(dev, nsensor->current_state);

nsensor->current_state = new_string;

}

}

This function is only ever called from hp_wmi_update_info() while

state->lock is held, so the free-and-replace itself is properly

serialized against concurrent updates.

fungible_show(), however, reads the same pointer after the lock has

already been dropped:

err = hp_wmi_update_info(state, info);

if (err)

return err;

switch (prop) {

...

case HP_WMI_PROPERTY_CURRENT_STATE:

seq_printf(seqf, "%s\n", nsensor->current_state);

break;

hp_wmi_update_info() takes state->lock int

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References