CVE-2026-98198

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pwm-fan) Stop RPM timer before freeing tach data

sample_timer() rearms the RPM timer and accesses the devm-managed

ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action

which stops the timer is registered before those arrays are allocated.

Since devres releases entries in reverse order, driver detach can free

the arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry

in that window accesses the freed tach data.

With a KASAN kernel, a test-only kprobe delayed entry to

pwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs

reported three four-byte reads and two four-byte writes in sample_timer()

after its backing devm allocations had been freed. The helper did not

invoke the timer callback, cleanup actions or free functions.

With the fix, three matching unbind runs completed without KASAN, BUG,

WARNING, Oops or panic. Instrumentation confirmed that timer retirement

c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References