Linux Kernel OCC hwmon Driver Unregisters sysfs Devices While Holding the OCC Lock, Causing a Deadlock When hwmon_device_unregister Tries to Flush sysfs Work Items

Status: NEW  |  Advisory ID: CVE-2026-80660

Key Details

What to Know

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (occ) unregister sysfs devices outside occ lock

occ_active(false) and occ_shutdown() unregister sysfs-backed devices while

occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can

wait for active sysfs callbacks to drain, and those callbacks can enter the

OCC update path and try to take occ->lock again. That gives the unregister

paths the lock ordering occ->lock -> sysfs callback drain, while a callback

has the opposite edge sysfs callback -> occ->lock.

This issue was found by our static analysis tool and then manually

reviewed against the current tree.

The grounded PoC kept the real unregister and callback carrier:

occ_shutdown()

hwmon_device_unregister()

occ_show_temp_1()

occ_update_response()

Lockdep reported the circular dependency with occ_shutdown() already

holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs

side:

WARNING: possible circular locking dependency detected

... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]

... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]

occ_update_response.isra.0+0xb/0x20 [vuln_msv]

occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]

*** DEADLOCK ***

Serialize hwmon registration and removal with a separate hwmon_lock.

Under that lock, detach occ->hwmon and update occ->active while occ->lock

is held so concurrent OCC state changes still see a stable state, then

drop occ->lock before calling hwmon_device_unregister(). Remove the

driver sysfs group before taking occ->lock in occ_shutdown(), so draining

the driver attributes cannot wait while the OCC mutex is held. Also make

OCC update callbacks return -ENODEV after deactivation, so callbacks that

already passed sysfs active protection do not poll the hardware after

teardown has detached the hwmon device. (NVD)

References