# CVE-2026-98200: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

CVE-2026-98200 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-98200, released October 6, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-98200
- Priority: High
- CVSS: 7.1 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98200

## Description

In the Linux kernel, the following vulnerability has been resolved:  hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()  nsensor->current_state is dynamically replaced as the sensor's state changes. update_numeric_sensor_from_wobj() does this by freeing the old string and installing a new one:  	if (strcmp(trimmed, nsensor->current_state)) { 		new_string = hp_wmi_strdup(dev, trimmed); 		if (new_string) { 			devm_kfree(dev, nsensor->current_state); 			nsensor->current_state = new_string; 		} 	}  This function is only ever called from hp_wmi_update_info() while state->lock is held, so the free-and-replace itself is properly serialized against concurrent updates.  fungible_show(), however, reads the same pointer after the lock has already been dropped:  	err = hp_wmi_update_info(state, info); 	if (err) 		return err;  	switch (prop) { 	... 	case HP_WMI_PROPERTY_CURRENT_STATE: 		seq_printf(seqf, "%s\n", nsensor->current_state); 		break;  hp_wmi_update_info() takes state->lock internally and releases it before returning, so by the time fungible_show() dereferences nsensor->current_state in seq_printf(), no lock is held. Two processes reading a sensor's current_state debugfs entry at overlapping times (or one reading it while another read of the same sensor triggers a refresh) can race: one thread's seq_printf() can be part-way through printing the string at the moment another thread's call into update_numeric_sensor_from_wobj() frees it with devm_kfree() and installs a new pointer, causing a use-after-free read.  Take state->lock around the read in fungible_show() as well, so it can never run concurrently with the free-and-replace in update_numeric_sensor_from_wobj().

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-98200](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98200.md) | Oct 6, 2026 |
| Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98200](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98200.md) | Oct 6, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-98200](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98200.md) | Oct 6, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.