CVE-2026-64492 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
iio: temperature: tmp006: use devm_iio_trigger_register
tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc() but registers it with plain iio_trigger_register(). The driver has no .remove() callback, so on module unload the trigger stays in the global trigger list while its memory is freed by devm, leaving a dangling entry.
Switch to devm_iio_trigger_register() so the registration is undone in the same devm scope as the allocation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability in question affects the Linux kernel's industrial input/output subsystem specifically within the tmp006 temperature sensor driver implementation. This issue represents a classic resource management flaw that occurs during module lifecycle operations, where improper handling of device trigger registration creates a persistent dangling reference in the kernel's global trigger list. The tmp006_probe function demonstrates inconsistent memory management practices by allocating an interrupt trigger using devm_iio_trigger_alloc() which establishes automatic cleanup through the device managed allocation framework, yet registers this trigger using the traditional iio_trigger_register() function that does not integrate with the same automatic resource handling mechanisms.
The technical flaw stems from a mismatch between allocation and registration methods within the driver's initialization sequence. When devm_iio_trigger_alloc() is called, it establishes a device-managed memory context where the allocated trigger structure will be automatically freed upon module unload or device removal. However, when iio_trigger_register() is subsequently invoked to register this trigger with the IIO subsystem, the registration occurs outside of the device management scope, creating a scenario where the trigger object remains registered in the global trigger list even though its memory has been deallocated by the devm framework. This creates a dangling pointer situation that can lead to kernel crashes, memory corruption, or unpredictable behavior when the system attempts to access the freed trigger structure.
The operational impact of this vulnerability extends beyond simple module unload operations and represents a potential security risk within embedded systems and industrial environments where these temperature sensors are commonly deployed. The dangling trigger entry can cause system instability during repeated module loading/unloading cycles, leading to kernel oops messages and system crashes that affect the reliability of critical sensor data collection processes. This type of vulnerability falls under the CWE-415: Double Free category, specifically manifesting as improper resource management where the same resource is freed twice in different contexts, though the manifestation occurs through a dangling reference rather than direct double-free behavior. The vulnerability impacts systems using the tmp006 temperature sensor driver in embedded Linux environments and can be exploited to cause denial of service conditions or potentially enable privilege escalation scenarios.
Mitigation strategies for this vulnerability involve implementing consistent device-managed resource handling throughout the driver's lifecycle operations. The recommended fix is to replace the traditional iio_trigger_register() call with devm_iio_trigger_register() which ensures that both allocation and registration occur within the same automatic resource management scope. This approach aligns with the Linux kernel's established best practices for device management and follows the principle of least privilege by ensuring proper cleanup of all allocated resources regardless of how the module is unloaded. The fix also addresses ATT&CK technique T1068: Exploitation for Privilege Escalation by preventing potential memory corruption scenarios that could be leveraged to gain elevated privileges within the kernel space. Additionally, this correction helps maintain the integrity of the IIO subsystem's global trigger list and prevents potential cascading failures when other drivers or subsystems attempt to reference the freed trigger structure during system operations.