CVE-2026-45914: Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

CVE-2026-45914: Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.

Jean Delvare points out that the patch does not completely
fix the reported problem, that it in fact introduces a
(new) race condition, and that it may actually not be needed in
the first place.

Various AI reviews agree. Specific and relevant AI feedback:

"
This reordering sets the driver data to NULL before removing the sensor
attributes in the loop below.

ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but
does not check if it is NULL before dereferencing it to access
data->sensors[].

If a userspace process reads a sensor file (like temp1_input) while this
delete function is running, could it race with the dev_set_drvdata(...,
NULL) call here and crash in ibmpex_show_sensor()?

Would it be safer to keep the original order where device_remove_file() is
called before clearing the driver data? device_remove_file() should wait
for any active sysfs callbacks to complete, which might already prevent the
use-after-free this patch intends to fix.
"

Revert the offending patch. If it can be shown that the originally reported
alleged race condition does indeed exist, it can always be re-introduced
with a complete fix.

The Linux kernel CVE team has assigned CVE-2026-45914 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.248 with commit 3ce9b7ae9d4d148672b35147aaf7987a4f82bb94 and fixed in 5.10.252 with commit 05112ba67c824ab416cd54307c0b50aba9f0047a
	Issue introduced in 6.1.160 with commit 533ead425f8109b02fecc7e72d612b8898ec347a and fixed in 6.1.165 with commit efd68429f23fb4015b0ebc2392334059e06fad18
	Issue introduced in 6.6.120 with commit fa37adcf1d564ef58b9dfb01b6c36d35c5294bad and fixed in 6.6.128 with commit f448acd86835a650f9ea83460b9ca347d3aafba5
	Issue introduced in 6.12.64 with commit 68d62e5bebbd118b763e8bb210d5cf2198ef450c and fixed in 6.12.75 with commit 914b47c9b824d3d74f31c764163edf93302100b1
	Issue introduced in 6.18.3 with commit 5aa2139201667c1f644601e4529c4acd6bf8db5a and fixed in 6.18.14 with commit 14a38784e09aebc21207dc32fffa05247fc3dd64
	Issue introduced in 6.19 with commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d and fixed in 6.19.4 with commit 894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d
	Issue introduced in 6.19 with commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d and fixed in 7.0 with commit 8bde3e395a85017f12af2b0ba5c3684f5af9c006

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-45914
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hwmon/ibmpex.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a
	https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18
	https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5
	https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1
	https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64
	https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d
	https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006