CVE-2026-97582

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (gpio-fan) Fix use-after-free in alarm work

fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing

cancels it. fan_alarm_notify() dereferences fan_data and its hwmon

device. On unbind, devres frees the interrupt, which only waits for

the handler itself, and then releases the hwmon device and fan_data,

so a pending fan_alarm_notify() can run after those frees.

Replace INIT_WORK() with devm_work_autocancel(), registered before

devm_request_irq(). The devres cleanup then frees the interrupt

first, so no new work can be queued, and cancels the work while

fan_data and the hwmon device are still alive.

This issue was found by an in-house static analysis tool.