CVE-2026-64213

hwmon: (lm90) Add lock protection to lm90_alert

State: Published
Severity: Not scored
Published: Jul 24, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (lm90) Add lock protection to lm90_alert

Sashiko reports:

lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock.

Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it.

If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register.

This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm.

Add the missing lock to lm90_alert() to solve the problem.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 1dc6a3469b5427e3bfd19010d7755ebc6019abc1Affected 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 02b88fa993582b4fe228b4143b330b0bb9f28353Affected 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 165ef777ec6f634a5e4b8d9b0dadca8ef91fa90eAffected 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before bed1fc32e0eb653806fa98afcf55f9a311fc4ce2Affected 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before b0b66aae8a94c3663d47e4000b0e81b89ce32186Affected 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 873e919e3101063a7a75989510ccfc125a4391cfAffected
LinuxLinux	5.3Affected before 5.3Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 1dc6a3469b5427e3bfd19010d7755ebc6019abc1Affected
7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 02b88fa993582b4fe228b4143b330b0bb9f28353Affected
7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 165ef777ec6f634a5e4b8d9b0dadca8ef91fa90eAffected
7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before bed1fc32e0eb653806fa98afcf55f9a311fc4ce2Affected
7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before b0b66aae8a94c3663d47e4000b0e81b89ce32186Affected
7a1d220ccb0cc2b808eb176fb05bf55a38179f3f to before 873e919e3101063a7a75989510ccfc125a4391cfAffected

LinuxLinux

5.3Affected
before 5.3Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.