Look up another CVE · open CVE-2026-98197 in the interactive tracker
CVE-2026-98197
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
Published 2026-10-06 (13 days ago) by the Linux kernel CNA. Subsystem drivers/hwmon. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-98197 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6568-1 · 2026-10-16 · text | 6.12.113-1 | Update the kernel and reboot. DSA-6568-1 shipped the fix on 2026-10-16, in 6.12.113-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When the fan/pwm 4-5 pins are not used as GPIO, w83791d_probe() creates the w83791d_group_fanpwm45 sysfs group on the I2C client device. The probe error path removes this group when a later initialization step fails, but the normal remove path only removes w83791d_group. As a result, the optional fan/pwm 4-5 sysfs files can remain after the driver is unbound. The callbacks associated with these files access the driver data, which is devm allocated and released after driver unbind. Leaving the sysfs files behind can therefore result in accesses to stale driver data. Remove w83791d_group_fanpwm45 during normal teardown as well. This issue was found by manual code inspection.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/hwmon/w83791d.c
- What this is
- W83791D HARDWARE MONITORING DRIVERMAINTAINERS section matched on drivers/hwmon/w83791d.c · linux-hwmon@vger.kernel.org · Maintained
- Kernel module
- w83791d
Check it on the machine
grep -wE 'CONFIG_HWMON|CONFIG_SENSORS_W83791D' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w w83791dPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_HWMON, CONFIG_SENSORS_W83791D
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-10-06 (13 days ago)source
- CVSS
- 7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/hwmon
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.28 | 5.10.271 | 081e3a784536 |
| 2.6.28 | 5.15.222 | b1d419eb3bc4 |
| 2.6.28 | 6.1.189 | 2ccf6c512290 |
| 2.6.28 | 6.6.158 | f6e2ab72f32d |
| 2.6.28 | 6.12.112 | 2dd37d00f1f1 |
| 2.6.28 | 6.18.54 | 2c381e6e0f03 |
| 2.6.28 | 7.2.8 | 583e04e88e75 |
| 2.6.28 | 7.3 | 0ff9c7775e51 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DSA-6568-1 | 2026-10-16 | trixie 6.12.113-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The trigger is a local read (or write) of the w83791d_group_fanpwm45 files (fan4_input, fan5_input, pwm4, pwm5...) that w83791d_remove() left on the I2C client kobject. These are sysfs files on a local hwmon I2C chip; no remote protocol carries any data into this path.
- AC:HAttack complexity, high
- The files only go stale after the driver is unbound or the module is unloaded, which takes real root via /sys/bus/i2c/drivers/w83791d/unbind or rmmod. It also needs W83791D hardware with fan4/5 pins not set as GPIO (GPIO reg bit 0x10). The attacker cannot arrange either and can only wait for them.
- PR:LPrivileges required, low
- Once the files are stale, fan4_input/fan5_input and the other fanpwm45 show attributes are S_IRUGO, so any unprivileged local user can read them and reach show_fan() -> w83791d_update_device(). The 0644 store attributes stay root-only.
- UI:NUser interaction, none
- Apart from the admin unbind already counted under AC, the attacker only needs to read the stale sysfs attributes. No victim has to open a file, mount anything or take any other action.
- S:UScope, unchanged
- The stale accesses corrupt kernel memory (devm-allocated w83791d_data or freed module text/data) in the same kernel that hosts the driver. No VM, IOMMU or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- A read racing unbind's devres_release_all() runs w83791d_update_device() on the freed devm w83791d_data, which is a use-after-free of a kmalloc object. After rmmod, the leftover kernfs nodes point to freed module attribute structs and show callbacks. Either can be groomed into a memory disclosure.
- I:HIntegrity impact, high
- w83791d_update_device() writes register values into the freed object (data->in[], fan[], fan_min[], valid, last_updated) after taking its mutex, which is a UAF write. After rmmod, the stale attributes make an indirect call through freed module memory, a possible control-flow hijack if that memory is reallocated.
- A:HAvailability impact, high
- Once unbind has set drvdata to NULL, any user reading fan4_input calls mutex_lock(&data->update_lock) on a NULL pointer and the kernel oopses. After module unload, reading the attribute jumps into unmapped module memory. Both can be repeated at will.