Executive brief
A vulnerability exists in the Linux kernel's thermal management system, which monitors and regulates hardware temperatures. If the system fails while setting up a new thermal sensor or zone, it may incorrectly clean up its internal memory. This could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive information.
Technical details
A use-after-free vulnerability exists in the Linux kernel thermal core component due to an improper error handling path in thermal_zone_device_register_with_trips(). If registration fails after the thermal zone device has been initialized, the error path fails to wait for the completion of the device's removal. If a userspace process has acquired a reference to the thermal zone's kobject, the thermal_release() function may not be triggered immediately, leading to the thermal zone structure being freed prematurely while still referenced. This is a local attack vector requiring low privileges. Patches have been released across multiple stable kernel branches (e.g., 6.6.y, 6.12.y, 6.18.y, 6.19.y).
Affected products
- Linux Linux Kernel 6.13 to 6.18.22, 6.19 to 6.19.12, 6.6.14 to 6.6.134, 6.8 to 6.12.81, 6.7.2, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-05-08: disclosed
- 2026-04-01: patched: Initial patch authored by Rafael J. Wysocki
- 2026-05-08: advisory
References
- https://git.kernel.org/stable/c/4d390f0e507dfb16d58f83a58d78d1150dc8b9d7
- https://git.kernel.org/stable/c/604da9c04c218362e1c1457304ebeb9c199d537c
- https://git.kernel.org/stable/c/9e07e3b81807edd356e1f794cffa00a428eff443
- https://git.kernel.org/stable/c/9e796001af97a1f7368d5114b7a8533dd98d797a
- https://git.kernel.org/stable/c/c4c7219e93319bba9ba0765dee597784c78f63c5