CVE-2026-23186

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()

The acpi_power_meter driver's .notify() callback function,

acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock

that is also acquired by callbacks in sysfs attributes of the device

being unregistered which is prone to deadlocks between sysfs access and

device removal.

Address this by moving the hwmon device removal in

acpi_power_meter_notify() outside the lock in question, but notice

that doing it alone is not sufficient because two concurrent

METER_NOTIFY_CONFIG notifications may be attempting to remove the

same device at the same time. To prevent that from happening, add a

new lock serializing the execution of the switch () statement in

acpi_power_meter_notify(). For simplicity, it is a static mutex

which should not be a problem from the performance perspective.

The new lock also allows the hwmon_device_register_with

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References