CVE record · CVE-2026-97582

hwmon: (gpio-fan) Fix use-after-free in alarm work

No CVSS scoreEPSS 0.0021 · 11th percentile

Published by the CVE Program (CNA: Linux) at 25 Sept 2026, 10:22 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected d6fe1360f42e86262153927986dea6502daff703 to before 7f96803f612134f585ab3b39e6d5b2d4b9c0606f git affected d6fe1360f42e86262153927986dea6502daff703 to before 594c62eea7c82f526054496e9fa9b895122a8016 git affected d6fe1360f42e86262153927986dea6502daff703 to before 6e67d9bdac810edacef78cbaeedd34445aa8ceb7 git affected d6fe1360f42e86262153927986dea6502daff703 to before e9fc7d53b2eb34c0a607d1659f49b46911aaf16c git affected d6fe1360f42e86262153927986dea6502daff703 to before 9b12bd724db9db318e3a68be17693583dc29a066 git affected d6fe1360f42e86262153927986dea6502daff703 to before 30755d3a5782cd704c8921cac8ee66dffe4383ea git affected d6fe1360f42e86262153927986dea6502daff703 to before c6ab7f855891877a16d2e2ddf0cd0305fd098a85 git affected d6fe1360f42e86262153927986dea6502daff703 to before a2471ed17b0e6ff7bfb6b2ea8e6e5b04c309d293 git Other versions: unaffected
Linux	Linux	affected 2.6.37 unaffected before 2.6.37 semver unaffected 5.10.273 to 5.10., inclusive semver unaffected 5.15.222 to 5.15., inclusive semver unaffected 6.1.189 to 6.1., inclusive semver unaffected 6.6.158 to 6.6., inclusive semver unaffected 6.12.111 to 6.12., inclusive semver unaffected 6.18.53 to 6.18., inclusive semver unaffected 7.2.7 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-97582
CNA: Linux
Tags: Linux kernel
Published: 25 Sept 2026
Updated: 30 Oct 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The hwmon gpio-fan driver in the Linux kernel has a use-after-free flaw in its alarm work handling. Versions from 2.6.37 up to the fixed commits listed for the affected branches are affected, with stable kernel releases 5.10.273, 5.15.222, 6.1.189 and 6.6.158 and later treated as unaffected. The source does not say how an attacker would reach the flaw or what they could do with it. Upgrade the Linux kernel to a fixed release for your branch.

Written 12 Nov 2026.

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0021, the 11th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 25 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.