hwmon: (powerz) Fix use-after-free on USB disconnect
Summary
| CVE | CVE-2026-31582 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-24 15:16:32 UTC |
| Updated | 2026-04-27 20:26:58 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Fix use-after-free on USB disconnect After powerz_disconnect() frees the URB and releases the mutex, a subsequent powerz_read() call can acquire the mutex and call powerz_read_data(), which dereferences the freed URB pointer. Fix by: - Setting priv->urb to NULL in powerz_disconnect() so that powerz_read_data() can detect the disconnected state. - Adding a !priv->urb check at the start of powerz_read_data() to return -ENODEV on a disconnected device. - Moving usb_set_intfdata() before hwmon registration so the disconnect handler can always find the priv pointer. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.000180000 probability, percentile 0.048130000 (date 2026-04-27)
Problem Types: CWE-416
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 4381a36abdf1c5c0323c1c51f869dc000115eb20 c78e1d4e48f23792adaa7c94251e22b0d9700a39 git | Not specified |
| CNA | Linux | Linux | affected 4381a36abdf1c5c0323c1c51f869dc000115eb20 9e1b798257f96d2e2a2639830eb71add545ce749 git | Not specified |
| CNA | Linux | Linux | affected 4381a36abdf1c5c0323c1c51f869dc000115eb20 7003ae4810ca83f0ddca85b768500e313c4b998c git | Not specified |
| CNA | Linux | Linux | affected 4381a36abdf1c5c0323c1c51f869dc000115eb20 61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4 git | Not specified |
| CNA | Linux | Linux | affected 4381a36abdf1c5c0323c1c51f869dc000115eb20 08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4 git | Not specified |
| CNA | Linux | Linux | affected 6.7 | Not specified |
| CNA | Linux | Linux | unaffected 6.7 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.83 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.24 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.19.14 6.19.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0.1 7.0.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/7003ae4810ca83f0ddca85b768500e313c4b998c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/9e1b798257f96d2e2a2639830eb71add545ce749 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/c78e1d4e48f23792adaa7c94251e22b0d9700a39 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.