CVE-2026-74552

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the lm90 driver when userspace reads sysfs attributes before driver registration is complete. This happens immediately after the devm hwmon device register with info() function is called, while the data->hwmon dev variable remains uninitialized. The process triggers lm90 update device() and lm90 update alarms locked(), which schedules report work and lm90 report alarms(). Subsequently, the NULL data->hwmon dev is passed to hwmon notify event(), leading to the crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.