CVE-2026-64213
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock. Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it. If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register. This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm. Add the missing lock to lm90_alert() to solve the problem.
Affected versions
Linux kernel versions
5.3
and later are affected. Fixed in
6.18.34,
7.0.11,
7.1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-64213?
CVE-2026-64213 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.3 onward and has been patched in 6.18.34, 7.0.11 and 7.1. CVE-2026-64213 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64213?
Yes. CVE-2026-64213 has been patched. Fixed versions include 6.18.34, 7.0.11 and 7.1. If you are running Linux kernel 5.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64213 actively exploited?
No. CVE-2026-64213 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.