In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ibmpex) fix use-after-free in high/low store
The ibmpexhighlowstore() function retrieves driver data using devget_drvdata() and uses it without validation. This creates a race condition where the sysfs callback can be invoked after the data structure is freed, leading to use-after-free.
Fix by adding a NULL check after devgetdrvdata(), and reordering operations in the deletion path to prevent TOCTOU.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68789.json"
}