From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B79D23E7BBD for ; Wed, 27 May 2026 12:23:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884630; cv=none; b=Oc7QvNpqTJpuazZyBzO8IJbL8o4RzR3usdYhyaZJnxtYwAzYuvG3Aohiyj2xXOivo7gh1dgsYFk3BjjD44WjAWbjhKImH7XUgjpSOpV/N5tpDWQAVUusHdn+ePE9Lj/WgiekjHC9p4giK46XwE4+DNyzUv5VBGyav9xH+GYJQLQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884630; c=relaxed/simple; bh=rH0LrzgnByHdBBqkgw+eaeUrCjfQ/tM3f87JdZCFkv4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=G/rhg2158T3pPJ4QW9JKaieaGlq51bQ9wpApZ99tY+P7zYk9V3qO3ALQ0X0X2nUtCJCYt4lSte9MTKXb78/ntW3JZMur8fCzmU4tAIUf5lFf4gnm2kMSWAuaD53FgUSfDDFtqbiENNO1lsELWsX1KWReRKcFeEHKHwRug2DWEpY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Hg36UTf/; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Hg36UTf/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 182271F000E9; Wed, 27 May 2026 12:23:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779884629; bh=JCa22ANQedpqHU3VPzy4aOr1wB9JgxAJF0Wcvq3ep3c=; h=From:To:Cc:Subject:Date:Reply-To; b=Hg36UTf/eAAVlVckEP0yYnemL1gYVp37jhXS2YUPaNT3wEYxryNMoYc1pp3asTUcn i5JmyBSNfy8wSoZv1c4ZzVGfyR1D9D6hyR0Dbawwz2NsCeT0nMyGObQNB+HIodQc6j oy756V3kVf2qNExxBvwQ0CJEFGlszOuYpUQaiyBk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-45914: Revert "hwmon: (ibmpex) fix use-after-free in high/low store" Date: Wed, 27 May 2026 14:19:16 +0200 Message-ID: <2026052723-CVE-2026-45914-eaae@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4172; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=zygSJ0AA5ok7DSlMG3svl85TR1ZQSsHUDKDthVbV/Fs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFliD/lFl13Nl5/JOufn4u079ph6hPd/i8w58HnaEZWfr 7omWyQWdcSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBErqcwzPcwf/R5/yfDubbl ayYpM/L7PHdTimFYcP5e8OzGJ8L3ZOVY3JgjP8lNZ6r4AwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: Revert "hwmon: (ibmpex) fix use-after-free in high/low store" This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d. Jean Delvare points out that the patch does not completely fix the reported problem, that it in fact introduces a (new) race condition, and that it may actually not be needed in the first place. Various AI reviews agree. Specific and relevant AI feedback: " This reordering sets the driver data to NULL before removing the sensor attributes in the loop below. ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but does not check if it is NULL before dereferencing it to access data->sensors[]. If a userspace process reads a sensor file (like temp1_input) while this delete function is running, could it race with the dev_set_drvdata(..., NULL) call here and crash in ibmpex_show_sensor()? Would it be safer to keep the original order where device_remove_file() is called before clearing the driver data? device_remove_file() should wait for any active sysfs callbacks to complete, which might already prevent the use-after-free this patch intends to fix. " Revert the offending patch. If it can be shown that the originally reported alleged race condition does indeed exist, it can always be re-introduced with a complete fix. The Linux kernel CVE team has assigned CVE-2026-45914 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10.248 with commit 3ce9b7ae9d4d148672b35147aaf7987a4f82bb94 and fixed in 5.10.252 with commit 05112ba67c824ab416cd54307c0b50aba9f0047a Issue introduced in 6.1.160 with commit 533ead425f8109b02fecc7e72d612b8898ec347a and fixed in 6.1.165 with commit efd68429f23fb4015b0ebc2392334059e06fad18 Issue introduced in 6.6.120 with commit fa37adcf1d564ef58b9dfb01b6c36d35c5294bad and fixed in 6.6.128 with commit f448acd86835a650f9ea83460b9ca347d3aafba5 Issue introduced in 6.12.64 with commit 68d62e5bebbd118b763e8bb210d5cf2198ef450c and fixed in 6.12.75 with commit 914b47c9b824d3d74f31c764163edf93302100b1 Issue introduced in 6.18.3 with commit 5aa2139201667c1f644601e4529c4acd6bf8db5a and fixed in 6.18.14 with commit 14a38784e09aebc21207dc32fffa05247fc3dd64 Issue introduced in 6.19 with commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d and fixed in 6.19.4 with commit 894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d Issue introduced in 6.19 with commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d and fixed in 7.0 with commit 8bde3e395a85017f12af2b0ba5c3684f5af9c006 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-45914 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/hwmon/ibmpex.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18 https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5 https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1 https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64 https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006