CVE-2026-26399-Disclosure

CVE-2026-26399: Stack-based Use-After-Return in ArduinoCoreSTM32 Legacy Versions Summary A stack-based use-after-return vulnerability exists in legacy versions of ArduinoCoreSTM32 prior to version 1.7.0. The issue is located in the pwmstart implementation, where a TIMHandleTypeDef object is...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the aspeedtachvaltorpm function in the drivers/hwmon/aspeed-g6-pwm-tach.c component of the Linux kernel is related to the improper implementation of the control flow. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: counter: rz-mtu3-cnt: do not use struct rzmtu3channel's dev member The counter driver can utilize HW channels 1 and 2, while the PWM driver can use HW channels 0, 1, 2, 3, 4, 6, 7. The dev member is assigned both by the counter...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: counter: rz-mtu3-cnt: prevent counter from being toggled multiple times The runtime PM counter is incremented/decremented each time the sysfs enable file is written to. If a user writes 0 to the sysfs enable file multiple times,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Since the LPC32xx PWM controllers have only one output, which is registered as the only PWM device/channel per controller, it is known in advance that pwm-hwpwm value is always 0. Bas...

CVE-2026-98198

A flaw was found in the Linux kernel's PWM fan driver. A local privileged user can cause a Denial of Service DoS or memory corruption by unbinding or detaching the driver. Due to an improper cleanup sequence, internal data structures are released while the sampling timer is still active, resultin...

SUSE CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

DEBIAN-CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98197

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

AZL-106185 CVE-2026-98198 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

UBUNTU-CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

EUVD-2026-93126

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98198 hwmon: (pwm-fan) Stop RPM timer before freeing tach data

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98198 hwmon: (pwm-fan) Stop RPM timer before freeing tach data

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98198

The Linux kernel contains a vulnerability in the hwmon (pwm-fan) component where the sample_timer() function can access freed memory. This occurs because the cleanup action to stop the RPM timer is registered before the ctx->tachs and ctx->pulses_per_revolution arrays are allocated; since d...

CVE-2026-98198

In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...

CVE-2026-98197

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

PT-2026-106526

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hwmon component specifically affecting the w83791d driver. When fan/pwm 4-5 pins are not used as GPIO, the w83791d probe function creates the w83791d group fanpwm4...