On July 19, 2026, CVE-2026-64038 landed in the National Vulnerability Database, detailing a use-after-free race condition in the Linux kernel’s lm90 hardware-monitoring driver. The bug can corrupt memory or crash a system during device removal, driver unload, or a failed sensor initialization. No native Windows kernel is directly affected, but the ripple reaches Windows environments that run Linux workloads—WSL, servers, embedded controllers, and appliances—making it a patch-now issue for mixed-estate administrators.

The Concrete Fix: Stopping Work Before the Sensor Disappears

The flaw lives in drivers/hwmon/lm90.c, a driver that services a broad family of digital temperature sensors found on motherboards, server boards, industrial controllers, and development kits. The core sequence is deceptively simple: during teardown or a probe failure, the driver unregistered and freed its hwmon device while deferred alert and reporting work could still run. The workers then referenced the freed memory, creating a classic use-after-free.

Specifically, lm90_probe() registered a managed cleanup action to cancel alert_work and report_work inside lm90_init_client() before calling devm_hwmon_device_register_with_info(). The Linux device-managed resource (devm) framework executes cleanup actions in reverse registration order. So during unbinding or a failed probe, the hwmon device was deallocated first, then the cleanup action tried to cancel the workers—but the window between those two steps left a gap where lm90_alert_work() or lm90_report_alarms() could call lm90_update_alarms() and dereference the now-dangling data->hwmon_dev pointer.

The upstream commit, authored by Sashiko, reorganizes the shutdown sequence. It cancels the workers in a separate step after the hwmon device is registered but before the interrupt handler is set up. On the way out, interrupts are disabled first, then the workers are cancelled, and only then is the hwmon device freed. A new shutdown flag prevents work from being re-armed during teardown. The fix landed in Linux stable releases 6.18.34 and 7.0.11, and is present in the 7.1 development tree (commit series: c98107817b0f, 479e297526ae, b09a45601094). The vulnerability was introduced with commit f6d0775119fb and affects kernels from version 6.0 onward.

At the time of publication, the NVD had not yet assigned a CVSS severity score or CWE classification. That data gap does not signal a low-risk bug; it simply means formal enrichment is pending.

What It Means for You, Depending on Your Role

Home and Enthusiast Windows Users

If your daily driver is a Windows 10 or 11 desktop and you never launch WSL, the CVE has zero native impact. The Windows hardware-monitoring stack (ACPI, chipset drivers, vendor utilities like HWMonitor) does not touch Linux’s lm90.c. Even if you run a virtual machine with Linux, the guest likely lacks direct access to physical I2C sensors, so exposure is minimal.

However, if you use WSL 2 daily, especially with custom kernels or hardware pass-through configurations (USB, I2C), the kernel serving your Linux environment could be vulnerable. For most WSL installs, the kernel is provided by Microsoft and receives updates through Windows Update. Check your WSL kernel version with uname -r inside a terminal. Microsoft’s WSL kernel is based on a long-term stable Linux release and typically backports security fixes; watch for an advisory that explicitly mentions CVE-2026-64038.

Power Users, Developers, and CI/CD Engineers

You may run bare-metal Linux, a custom WSL kernel, or rely on CI/CD runners that spin up Linux containers on Windows hosts. The lm90 driver often shows up on development boards (Raspberry Pi, BeagleBone), single-board computers with I2C sensor add-ons, and industrial prototyping kits. If you load and unload the lm90 module during testing or develop drivers that interact with hwmon, the race is more likely to trigger during module reinsertion or probe failures.

Practical check: lsmod | grep lm90 will tell you if the driver is loaded. If it is, and your kernel predates the fix, apply updates from your distribution. Rolling-release distros (Arch, openSUSE Tumbleweed) likely received the patch within days. Stable distros (Ubuntu LTS, Debian) will release it through their security channels—verify with apt or dnf changelogs.

IT Administrators and Windows Enterprise Fleets

The real weight of CVE-2026-64038 lands on server rooms, edge appliances, and embedded systems—many of which are managed from Windows consoles. An entire class of products runs Linux internally: baseband management controllers (BMC), storage arrays, network switches, digital signage, medical devices, and factory controllers. These appliances often bundle a vendor-maintained Linux kernel, and you cannot simply run yum update. You need a firmware or OS image from the manufacturer.

Key actions for Windows-centric infrastructure teams:
- Inventory Linux-based appliances and servers. Ask vendors for a software bill of materials (SBOM) and patch status against CVE-2026-64038.
- For in-house Linux servers, apply the latest kernel from your enterprise Linux distribution (Red Hat, SUSE, Ubuntu Advantage). A kernel update requires a reboot; schedule it according to operational windows.
- For WSL environments on developer workstations, ensure the Microsoft-provided WSL kernel is up to date. Use wsl --update in PowerShell and verify the kernel version inside WSL.
- Do not make the mistake of blindly pushing a Windows cumulative update thinking it fixes this bug. It won’t. The CVE is Linux-only; the action is on the Linux side of your hybrid estate.

How We Got Here: A Mature Driver’s Hidden Race

The LM90 family of sensors has been a staple of hardware monitoring for over two decades. Originally designed by National Semiconductor, the chips communicate over I2C/SMBus and measure local and remote diode temperatures. They appear in servers to track CPU and memory module thermals, in industrial machines to monitor power stages, and even in some laptops. The Linux driver, lm90.c, supports dozens of compatible devices from multiple manufacturers.

As Linux kernel concurrency evolved and sanitizers (KASAN, lockdep) became standard in testing, subtle ordering bugs in mature drivers surfaced. The devm resource management framework, while reducing boilerplate, introduced a hidden dependency: cleanup actions must be registered in the exact reverse order of the objects’ lifetimes. In 2020, commit f6d0775119fb restructured the lm90 driver to use devm, but the action that cancelled deferred workers was registered too early. For nearly six years, the race remained dormant until a probe-failure or explicit driver unbind triggered it.

Delayed work is inherently asynchronous. lm90_alert_work() and lm90_report_alarms() handle hardware alerts and periodic reporting, respectively. An interrupt can fire just as the device is being removed, scheduling work that references a data structure about to be freed. Without a shutdown flag, no amount of work cancellation can guarantee safety if new work can be armed. The fix therefore isn’t just a reordering—it’s a lifecycle state machine that explicitly transitions from active to shutdown to drained.

What to Do Now: Step-by-Step Guidance

For Linux Systems You Control

  1. Identify kernel version: uname -r
  2. Check if lm90 is loaded: lsmod | grep lm90; also check modinfo lm90 for the module description.
  3. Correlate with distribution advisories: Use your package manager to check for a kernel update that lists CVE-2026-64038. For example, on Debian/Ubuntu: apt changelog linux-image-$(uname -r) | grep -i cve-2026-64038.
  4. Install the patched kernel: Follow your distribution’s standard procedure. For Ubuntu: sudo apt update && sudo apt upgrade. For Red Hat families: sudo dnf update kernel.
  5. Reboot and verify: After reboot, confirm the kernel version and that the lm90 driver (if used) is functioning without issues. dmesg | grep -i lm90 can show driver initialization messages.

For WSL on Windows

  • Update WSL kernel: In PowerShell (as Administrator), run wsl --update. Check that the kernel version inside WSL matches the latest Microsoft WSL kernel release. If a custom kernel is in use, rebuild it from a source that includes the fix.
  • Verify the fix: Mount the kernel source or config if using a custom build, and confirm the patch commits are applied. For the Microsoft-provided kernel, watch for a release note that includes CVE-2026-64038.

For Appliances and Embedded Devices

  • Contact the vendor: Provide the CVE number and ask for a timeline. If the device is critical, press for a hotfix or firmware update.
  • Assess the impact: Determine if the device exposes temperature monitoring externally. In many appliances, internal sensors are not attack surfaces, but a crash from a race could still disrupt operation.
  • Mitigation without patching: If an update is unavailable and the device allows it, blacklisting the lm90 module (modprobe -r lm90; echo "blacklist lm90" > /etc/modprobe.d/lm90.conf) can remove the attack surface. Caution: This will disable temperature telemetry; only do it if the loss of monitoring is acceptable and you understand the thermal management implications.

For Windows-Only Environments with No Linux Footprint

No action required. However, this is a good moment to conduct a quick inventory: do any of your Windows servers use a Linux-based BMC or run WSL for management scripts? If yes, include those components in the assessment.

Outlook: What to Watch Next

The NVD is expected to publish CVSS vectors and a CWE classification within days. That scoring will help security teams prioritize, but it won’t change the fix itself. More importantly, enterprise Linux distributions will push out kernel updates in their next patch cycles. Keep an eye on advisories from Red Hat, SUSE, Ubuntu, and Debian—they will detail the exact package versions that contain the correction.

Beyond this CVE, the kernel community may audit other drivers that combine devm cleanup, deferred work, and subsystem device registration. The pattern of “worker outliving the object it references” is not unique to lm90. Maintainers have already begun discussing a broader checklist for such drivers, and future stable kernels may include proactive fixes. If you develop or maintain kernel modules, review your teardown sequences against the four questions this bug forces: is new work still allowed, is queued work pending, is work executing now, and are its data structures still valid?

For Windows-heavy organizations, this incident reinforces the need to treat Linux subsystems—even a temperature sensor driver—as part of the security boundary when they sit inside WSL, servers, or edge devices. Keep your WSL kernel updated, require SBOMs from appliance vendors, and remember that a missing CVSS score is not a reason to delay patching a genuine kernel race.