CVE-2026-98197 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
When the fan/pwm 4-5 pins are not used as GPIO, w83791d_probe() creates the w83791d_group_fanpwm45 sysfs group on the I2C client device.
The probe error path removes this group when a later initialization step fails, but the normal remove path only removes w83791d_group. As a result, the optional fan/pwm 4-5 sysfs files can remain after the driver is unbound.
The callbacks associated with these files access the driver data, which is devm allocated and released after driver unbind. Leaving the sysfs files behind can therefore result in accesses to stale driver data.
Remove w83791d_group_fanpwm45 during normal teardown as well.
This issue was found by manual code inspection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified within the Linux kernel hardware monitoring subsystem for the W83791D sensor driver represents a classic resource management error involving improper cleanup of sysfs interface files during device removal operations. This specific flaw arises from an inconsistency in how the driver handles its lifecycle events, particularly when transitioning between active operation and unbinding states. The w83791d_probe function is responsible for initializing the hardware and exposing various control interfaces to user space through the sysfs filesystem. Among these interfaces are groups of files that allow userspace applications to read fan speeds or write pulse-width modulation values to control cooling fans. Specifically, when pins four and five on the W83791D chip are not configured as general-purpose input/output lines, the driver creates a dedicated sysfs group named w83791d_group_fanpwm45 to expose these functionalities. This design choice allows for flexible hardware configuration but introduces complexity in memory management during teardown sequences.
The core technical flaw lies in the asymmetry between error handling and normal removal paths within the driver code. During the probe phase, if an initialization step fails after the w83791d_group_fanpwm45 group has been created, the existing error path correctly invokes the cleanup routine to remove this specific sysfs group before aborting the probe operation. This ensures that no dangling references remain in such failure scenarios. However, the normal removal path, which is executed when the driver is intentionally unbound from the device or during system shutdown, fails to perform an equivalent cleanup for the w83791d_group_fanpwm45 group. While it correctly removes the primary sysfs group associated with other hardware features, it neglects to unregister the optional fan and pwm files linked to pins four and five. This oversight leaves these file entries present in the virtual filesystem even after the driver has detached from the underlying I2C client device.
The operational impact of this vulnerability is significant due to the subsequent access patterns associated with sysfs attributes. The callback functions registered for reading or writing data through these specific sysfs files rely on accessing private driver data structures that are allocated using managed memory allocation mechanisms, such as devm_kzalloc. These resources are automatically released by the kernel when the device is unbound and the driver's remove function completes its execution. Consequently, if a user space process attempts to read from or write to one of these orphaned sysfs files after the driver has been unloaded, it triggers access to memory that has already been freed. This scenario constitutes a use-after-free condition, where stale pointers are dereferenced against deallocated memory regions. Such an event can lead to kernel panics, data corruption, or potentially allow for arbitrary code execution if an attacker can carefully craft inputs to exploit the corrupted state of the kernel heap.
From a security taxonomy perspective, this vulnerability aligns with CWE-416, which describes Use After Free vulnerabilities. The root cause is categorized under CWE-252, Checkpoint Failure, as the driver fails to perform necessary cleanup checks before releasing resources. In terms of attack vectors and tactics, this flaw could be leveraged within the MITRE ATT&CK framework's Execution or Privilege Escalation techniques if an attacker can trigger the unbind operation while maintaining access to the sysfs interface, although typically such vulnerabilities require local physical or network-adjacent access depending on how the I2C device is exposed. The vulnerability was discovered through manual code inspection rather than automated fuzzing, highlighting the importance of thorough review of driver lifecycle management logic in kernel development.
To mitigate this risk, the recommended remediation involves modifying the w83791d_remove function to explicitly unregister the w83791d_group_fanpwm45 sysfs group during normal teardown operations. This ensures symmetry with the error handling path and guarantees that all user-facing interfaces are removed before any associated driver data is freed by the managed resource framework. Developers should verify that all dynamically created sysfs groups have corresponding removal calls in both success and failure paths of device initialization routines. Additionally, implementing static analysis tools focused on detecting mismatched allocation and deallocation patterns can help prevent similar issues in other hardware drivers within the kernel tree. System administrators relying on affected kernels should apply vendor-provided security patches that include this fix to restore proper resource isolation and prevent potential exploitation through stale memory access.