# hwmon: (gpio-fan) Fix use-after-free in alarm work

CVE record · `CVE-2026-97582`

- **Identifiers:** `CVE-2026-97582`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 25 Sept 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 25 Sept 2026, 10:22 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before 7f96803f612134f585ab3b39e6d5b2d4b9c0606f` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before 594c62eea7c82f526054496e9fa9b895122a8016` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before 6e67d9bdac810edacef78cbaeedd34445aa8ceb7` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before e9fc7d53b2eb34c0a607d1659f49b46911aaf16c` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before 9b12bd724db9db318e3a68be17693583dc29a066` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before 30755d3a5782cd704c8921cac8ee66dffe4383ea` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before c6ab7f855891877a16d2e2ddf0cd0305fd098a85` (git)
  - affected: `d6fe1360f42e86262153927986dea6502daff703 to before a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `2.6.37`
  - unaffected: `before 2.6.37` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.222 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.189 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.158 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.111 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.53 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.7 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

> The hwmon gpio-fan driver in the Linux kernel has a use-after-free flaw in its alarm work handling. Versions from 2.6.37 up to the fixed commits listed for the affected branches are affected, with stable kernel releases 5.10.273, 5.15.222, 6.1.189 and 6.6.158 and later treated as unaffected. The source does not say how an attacker would reach the flaw or what they could do with it. Upgrade the Linux kernel to a fixed release for your branch.

Written 12 Nov 2026.

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0021, the 11th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 25 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-97582](https://www.cve.org/CVERecord?id=CVE-2026-97582)
- [NVD: CVE-2026-97582](https://nvd.nist.gov/vuln/detail/CVE-2026-97582)

### References from the CNA

- <https://git.kernel.org/stable/c/7f96803f612134f585ab3b39e6d5b2d4b9c0606f>
- <https://git.kernel.org/stable/c/594c62eea7c82f526054496e9fa9b895122a8016>
- <https://git.kernel.org/stable/c/6e67d9bdac810edacef78cbaeedd34445aa8ceb7>
- <https://git.kernel.org/stable/c/e9fc7d53b2eb34c0a607d1659f49b46911aaf16c>
- <https://git.kernel.org/stable/c/9b12bd724db9db318e3a68be17693583dc29a066>
- <https://git.kernel.org/stable/c/30755d3a5782cd704c8921cac8ee66dffe4383ea>
- <https://git.kernel.org/stable/c/c6ab7f855891877a16d2e2ddf0cd0305fd098a85>
- <https://git.kernel.org/stable/c/a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-97582>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-97582/>. Everything for agents: <https://agentprime.io/llms.txt>.