CVE-2026-64038

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (lm90) Stop work before releasing hwmon device<br /> <br /> Sashiko reports:<br /> <br /> In lm90_probe(), the devm action to cancel the alert_work and report_work<br /> (lm90_restore_conf) is registered in lm90_init_client() before<br /> devm_hwmon_device_register_with_info() is called.<br /> <br /> Because devm executes cleanup actions in reverse order during module<br /> unbind or probe failure, the hwmon device is unregistered and freed first.<br /> <br /> If lm90_alert_work() or lm90_report_alarms() runs in the window between<br /> the hwmon device being freed and the delayed works being cancelled,<br /> lm90_update_alarms() will dereference the freed data-&gt;hwmon_dev here.<br /> <br /> Fix the problem by canceling the workers separately after registering<br /> the hwmon device and before registering the interrupt handler. This ensures<br /> that the workers are canceled after interrupts are disabled and before<br /> the hwmon device is released. Add "shutdown" flag to indicate that device<br /> shutdown is in progress to prevent workers from being re-armed.