CVE-2026-89937 iio: chemical: sgp30: Handle IAQ thread creation failure
A flaw in the SGP30 sensor driver causes a null pointer dereference during device removal if thread creation fails, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89937?
CVE-2026-89937 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: sgp30: Handle IAQ thread creation failure
kthread_run() can fail and return an error pointer, but sgp_probe() stores it and returns success, so the device is registered without its IAQ thread and sgp_remove() later passes the error pointer to kthread_stop(). Return the error from probe instead.
Which versions are affected by CVE-2026-89937?
How do I fix CVE-2026-89937?
Apply the vendor's patch.
Is CVE-2026-89937 being exploited?
There is no known exploitation of CVE-2026-89937 in the wild and no public exploit code.
Sources
Also known as AZL-101295, BELL-CVE-2026-89937, DEBIAN-CVE-2026-89937, GHSA-gxqw-4h89-82f3, UBUNTU-CVE-2026-89937.