PT-2026-8194 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-02-14 · CVE-2026-23186

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The acpi power meter driver in the Linux kernel contains a flaw related to deadlocks within the acpi power meter notify() function. This function calls hwmon device unregister() under a lock also used by sysfs attribute callbacks during device unregistration, creating a potential deadlock between sysfs access and device removal. The issue arises from concurrent METER NOTIFY CONFIG notifications attempting to remove the same device simultaneously. A new static mutex has been introduced to serialize the execution of the switch statement within acpi power meter notify(), preventing concurrent removal attempts. This lock also allows hwmon device register with info() to be called outside the inner lock, preventing manipulation of the resource object during hwmon device registration. Serialization of ACPI netlink message sending within acpi power meter notify() further ensures consistent handling of firmware notifications and related netlink messages. Checks have been added to prevent attempts to unregister a hwmon device pointer if hwmon device register with info() fails, resulting in an error pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-23186

Affected Products

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23186.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-23186 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23186 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23186 · Vendor Advisory
• https://git.kernel.org/stable/c/8860ddf0e07be37169d4ef9f2618e39fca934a66 · Patch
• https://git.kernel.org/stable/c/615901b57b7ef8eb655f71358f7e956e42bcd16b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23186 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23186 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23186 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/2022716622771720363 · Twitter Post
• https://git.kernel.org/linus/615901b57b7ef8eb655f71358f7e956e42bcd16b · Note
• https://t.me/CVEtracker/44722 · Telegram Post