In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before devm_hwmon_device_register_with_info() is called. Because devm executes cleanup actions in reverse order during module unbind or probe failure, the hwmon device is unregistered and freed first. If lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here. Fix the problem by canceling the workers separately after registering the hwmon device and before registering the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released. Add "shutdown" flag to indicate that device shutdown is in progress to prevent workers from being re-armed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to     cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before     devm_hwmon_device_register_with_info() is called. Because devm executes cleanup actions in reverse order     during module unbind or probe failure, the hwmon device is unregistered and freed first. If     lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the     delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here. Fix     the problem by canceling the workers separately after registering the hwmon device and before registering     the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before     the hwmon device is released. Add shutdown flag to indicate that device shutdown is in progress to     prevent workers from being re-armed. (CVE-2026-64038)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
327953	Linux Distros Unpatched Vulnerability : CVE-2026-64038	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-64038

medium

Tenable Plugins

high

high

high

high

medium