Executive brief
The Linux kernel's thermal management subsystem contains a double-free memory vulnerability in the thermal zone registration and unregistration code. When a thermal device is unregistered, the system incorrectly attempts to free memory twice, leading to heap corruption that can cause system crashes or be exploited for privilege escalation.
Technical details
The vulnerability exists in drivers/thermal/thermal_of.c where a thermal zone parameters structure (tzp) is allocated on the heap and then freed twice during unregistration. Following commit 3d439b1a2ad3, thermal_zone_device_register() allocates and manages its own copy of tzp, freeing it on unregister. The thermal_of_zone_register() function was not updated, still allocating tzp on the heap and attempting to free it after passing it to the register function, resulting in a double-free when unregister is called. The fix involves allocating tzp on the stack instead of the heap, eliminating the manual free and the subsequent double-free. This affects kernel versions 6.4 and later where the problematic commit was introduced.
Affected products
- Linux Linux kernel 6.4 and later
Timeline
- 2023-07-24: disclosed
- 2023-07-24: patched
- 2023-08-03: other: Fix included in stable tree
- 2025-12-24: kev added