Strix
74.8K

CVE-2026-97582

UnknownEPSS 0.21%

Last modified

CVE-2026-97582 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels it. fan_alarm_notify() dereferences fan_data and its hwmon device. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels it. fan_alarm_notify() dereferences fan_data and its hwmon device. On unbind, devres frees the interrupt, which only waits for the handler itself, and then releases the hwmon device and fan_data, so a pending fan_alarm_notify() can run after those frees. Replace INIT_WORK() with devm_work_autocancel(), registered before devm_request_irq(). The devres cleanup then frees the interrupt first, so no new work can be queued, and cancels the work while fan_data and the hwmon device are still alive. This issue was found by an in-house static analysis tool.

Metrics

EPSS Probability
0.21%

10.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d6fe1360f42e86262153927986dea6502daff703, < 7f96803f612134f585ab3b39e6d5b2d4b9c0606f; >= d6fe1360f42e86262153927986dea6502daff703, < 594c62eea7c82f526054496e9fa9b895122a8016; >= d6fe1360f42e86262153927986dea6502daff703, < 6e67d9bdac810edacef78cbaeedd34445aa8ceb7; >= d6fe1360f42e86262153927986dea6502daff703, < e9fc7d53b2eb34c0a607d1659f49b46911aaf16c; >= d6fe1360f42e86262153927986dea6502daff703, < 9b12bd724db9db318e3a68be17693583dc29a066; >= d6fe1360f42e86262153927986dea6502daff703, < 30755d3a5782cd704c8921cac8ee66dffe4383ea; >= d6fe1360f42e86262153927986dea6502daff703, < c6ab7f855891877a16d2e2ddf0cd0305fd098a85; >= d6fe1360f42e86262153927986dea6502daff703, < a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293
LinuxLinux2.6.37

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-97582?
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix use-after-free in alarm work fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing cancels it. fan_alarm_notify() dereferences fan_data and its hwmon device. On unbind, devres frees the interrupt, which only waits for the handler itself, and then releases the hwmon device and fan_data, so a pending fan_alarm_notify() can run after those frees. Replace INIT_WORK() with devm_work_autocancel(), registered before devm_request_irq(). The devres cleanup then frees the interrupt first, so no new work can be queued, and cancels the work while fan_data and the hwmon device are still alive. This issue was found by an in-house static analysis tool.
How severe is CVE-2026-97582?
Severity scoring for CVE-2026-97582 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-97582?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-97582?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST