CVE-2026-23186 (GCVE-0-2026-23186)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-02-14 16:27
VLAI?
Title
hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() The acpi_power_meter driver's .notify() callback function, acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock that is also acquired by callbacks in sysfs attributes of the device being unregistered which is prone to deadlocks between sysfs access and device removal. Address this by moving the hwmon device removal in acpi_power_meter_notify() outside the lock in question, but notice that doing it alone is not sufficient because two concurrent METER_NOTIFY_CONFIG notifications may be attempting to remove the same device at the same time. To prevent that from happening, add a new lock serializing the execution of the switch () statement in acpi_power_meter_notify(). For simplicity, it is a static mutex which should not be a problem from the performance perspective. The new lock also allows the hwmon_device_register_with_info() in acpi_power_meter_notify() to be called outside the inner lock because it prevents the other notifications handled by that function from manipulating the "resource" object while the hwmon device based on it is being registered. The sending of ACPI netlink messages from acpi_power_meter_notify() is serialized by the new lock too which generally helps to ensure that the order of handling firmware notifications is the same as the order of sending netlink messages related to them. In addition, notice that hwmon_device_register_with_info() may fail in which case resource->hwmon_dev will become an error pointer, so add checks to avoid attempting to unregister the hwmon device pointer to by it in that case to acpi_power_meter_notify() and acpi_power_meter_remove().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 16746ce8adfe04f9ff8df75c1133286ba93c0e17 , < 8860ddf0e07be37169d4ef9f2618e39fca934a66 (git)
Affected: 16746ce8adfe04f9ff8df75c1133286ba93c0e17 , < 615901b57b7ef8eb655f71358f7e956e42bcd16b (git)
Create a notification for this product.
    Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/acpi_power_meter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8860ddf0e07be37169d4ef9f2618e39fca934a66",
              "status": "affected",
              "version": "16746ce8adfe04f9ff8df75c1133286ba93c0e17",
              "versionType": "git"
            },
            {
              "lessThan": "615901b57b7ef8eb655f71358f7e956e42bcd16b",
              "status": "affected",
              "version": "16746ce8adfe04f9ff8df75c1133286ba93c0e17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/acpi_power_meter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()\n\nThe acpi_power_meter driver\u0027s .notify() callback function,\nacpi_power_meter_notify(), calls hwmon_device_unregister() under a lock\nthat is also acquired by callbacks in sysfs attributes of the device\nbeing unregistered which is prone to deadlocks between sysfs access and\ndevice removal.\n\nAddress this by moving the hwmon device removal in\nacpi_power_meter_notify() outside the lock in question, but notice\nthat doing it alone is not sufficient because two concurrent\nMETER_NOTIFY_CONFIG notifications may be attempting to remove the\nsame device at the same time.  To prevent that from happening, add a\nnew lock serializing the execution of the switch () statement in\nacpi_power_meter_notify().  For simplicity, it is a static mutex\nwhich should not be a problem from the performance perspective.\n\nThe new lock also allows the hwmon_device_register_with_info()\nin acpi_power_meter_notify() to be called outside the inner lock\nbecause it prevents the other notifications handled by that function\nfrom manipulating the \"resource\" object while the hwmon device based\non it is being registered.  The sending of ACPI netlink messages from\nacpi_power_meter_notify() is serialized by the new lock too which\ngenerally helps to ensure that the order of handling firmware\nnotifications is the same as the order of sending netlink messages\nrelated to them.\n\nIn addition, notice that hwmon_device_register_with_info() may fail\nin which case resource-\u003ehwmon_dev will become an error pointer,\nso add checks to avoid attempting to unregister the hwmon device\npointer to by it in that case to acpi_power_meter_notify() and\nacpi_power_meter_remove()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-14T16:27:15.505Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8860ddf0e07be37169d4ef9f2618e39fca934a66"
        },
        {
          "url": "https://git.kernel.org/stable/c/615901b57b7ef8eb655f71358f7e956e42bcd16b"
        }
      ],
      "title": "hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23186",
    "datePublished": "2026-02-14T16:27:15.505Z",
    "dateReserved": "2026-01-13T15:37:45.985Z",
    "dateUpdated": "2026-02-14T16:27:15.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23186\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:56.373\",\"lastModified\":\"2026-03-18T15:10:00.913\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()\\n\\nThe acpi_power_meter driver\u0027s .notify() callback function,\\nacpi_power_meter_notify(), calls hwmon_device_unregister() under a lock\\nthat is also acquired by callbacks in sysfs attributes of the device\\nbeing unregistered which is prone to deadlocks between sysfs access and\\ndevice removal.\\n\\nAddress this by moving the hwmon device removal in\\nacpi_power_meter_notify() outside the lock in question, but notice\\nthat doing it alone is not sufficient because two concurrent\\nMETER_NOTIFY_CONFIG notifications may be attempting to remove the\\nsame device at the same time.  To prevent that from happening, add a\\nnew lock serializing the execution of the switch () statement in\\nacpi_power_meter_notify().  For simplicity, it is a static mutex\\nwhich should not be a problem from the performance perspective.\\n\\nThe new lock also allows the hwmon_device_register_with_info()\\nin acpi_power_meter_notify() to be called outside the inner lock\\nbecause it prevents the other notifications handled by that function\\nfrom manipulating the \\\"resource\\\" object while the hwmon device based\\non it is being registered.  The sending of ACPI netlink messages from\\nacpi_power_meter_notify() is serialized by the new lock too which\\ngenerally helps to ensure that the order of handling firmware\\nnotifications is the same as the order of sending netlink messages\\nrelated to them.\\n\\nIn addition, notice that hwmon_device_register_with_info() may fail\\nin which case resource-\u003ehwmon_dev will become an error pointer,\\nso add checks to avoid attempting to unregister the hwmon device\\npointer to by it in that case to acpi_power_meter_notify() and\\nacpi_power_meter_remove().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nhwmon: (acpi_power_meter) Soluciona interbloqueos relacionados con acpi_power_meter_notify()\\n\\nLa funci\u00f3n de callback .notify() del controlador acpi_power_meter, acpi_power_meter_notify(), llama a hwmon_device_unregister() bajo un bloqueo que tambi\u00e9n es adquirido por callbacks en atributos sysfs del dispositivo que se est\u00e1 desregistrando, lo cual es propenso a interbloqueos entre el acceso a sysfs y la eliminaci\u00f3n del dispositivo.\\n\\nAborda esto moviendo la eliminaci\u00f3n del dispositivo hwmon en acpi_power_meter_notify() fuera del bloqueo en cuesti\u00f3n, pero ten en cuenta que hacerlo solo no es suficiente porque dos notificaciones METER_NOTIFY_CONFIG concurrentes pueden estar intentando eliminar el mismo dispositivo al mismo tiempo. Para evitar que eso suceda, a\u00f1ade un nuevo bloqueo serializando la ejecuci\u00f3n de la sentencia switch () en acpi_power_meter_notify(). Para simplificar, es un mutex est\u00e1tico lo cual no deber\u00eda ser un problema desde la perspectiva del rendimiento.\\n\\nEl nuevo bloqueo tambi\u00e9n permite que hwmon_device_register_with_info() en acpi_power_meter_notify() sea llamado fuera del bloqueo interno porque evita que las otras notificaciones manejadas por esa funci\u00f3n manipulen el objeto \u0027resource\u0027 mientras el dispositivo hwmon basado en \u00e9l est\u00e1 siendo registrado. El env\u00edo de mensajes netlink ACPI desde acpi_power_meter_notify() tambi\u00e9n es serializado por el nuevo bloqueo, lo cual generalmente ayuda a asegurar que el orden de manejo de las notificaciones de firmware es el mismo que el orden de env\u00edo de los mensajes netlink relacionados con ellas.\\n\\nAdem\u00e1s, ten en cuenta que hwmon_device_register_with_info() puede fallar, en cuyo caso resource-\u0026gt;hwmon_dev se convertir\u00e1 en un puntero de error, as\u00ed que a\u00f1ade comprobaciones para evitar intentar desregistrar el dispositivo hwmon al que apunta en ese caso a acpi_power_meter_notify() y acpi_power_meter_remove().\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15\",\"versionEndExcluding\":\"6.18.10\",\"matchCriteriaId\":\"3D999201-C599-4A3B-A14D-669CF95A41B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/615901b57b7ef8eb655f71358f7e956e42bcd16b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8860ddf0e07be37169d4ef9f2618e39fca934a66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.