CVE-2026-74552 hwmon: (lm90) Only report alarms if driver is ready
A local attacker can trigger a kernel crash by reading sysfs attributes before the lm90 driver is fully initialized, causing a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74552?
CVE-2026-74552 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm90) Only report alarms if driver is ready
Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initialized. This can trigger a NULL pointer access since lm90_update_device() and with it lm90_update_alarms_locked() will be called. This call schedules report_work and lm90_report_alarms(), which passes the still-NULL data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer dereference.
Fix the problem by only scheduling the report and alert workers data->hwmon_dev is set.
Which versions are affected by CVE-2026-74552?
How do I fix CVE-2026-74552?
Apply the vendor's patch.
Is CVE-2026-74552 being exploited?
There is no known exploitation of CVE-2026-74552 in the wild and no public exploit code.
Sources
Also known as AZL-96252, BELL-CVE-2026-74552, DEBIAN-CVE-2026-74552, GHSA-ccxm-23rv-p7vf, UBUNTU-CVE-2026-74552.