Linux Kernel hwmon lm90 Device Management Vulnerability

A vulnerability in the Linux kernel's lm90 hardware monitoring driver can lead to a use-after-free issue. This occurs because the driver unregisters and frees the hwmon device before canceling scheduled work tasks. If these tasks are executed in the interim, they can access freed memory, causing potential instability or crashes. The vulnerability affects the stable versions of the Linux kernel.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, leading to memory corruption and potentially allowing for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by loading the lm90 driver, which will register a hwmon device and schedule work tasks. If the hwmon device is then unregistered and freed before these tasks are canceled, the scheduled work can attempt to access the freed device data, causing a use-after-free condition.

Remediation

Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed. The patch is available in the Linux kernel stable tree.