Executive brief
A vulnerability in the Linux kernel's thermal management system could allow a local attacker to cause system instability or a crash. The issue stems from how the system handles the registration and removal of thermal zones, which manage hardware temperature. If these processes are interrupted or occur simultaneously, it can lead to memory errors that compromise the reliability of the operating system.
Technical details
Two distinct issues exist in the Linux kernel thermal core. First, a memory leak occurs if thermal_zone_device_register_with_trips() fails after a governor has been added but before registration is complete, as the governor is not properly removed. Second, a use-after-free vulnerability exists in thermal_zone_device_unregister() because it calls thermal_set_governor() without acquiring the necessary thermal zone lock. This creates a race condition with governor updates initiated via sysfs. The fix involves moving thermal_set_governor() calls to thermal_release() and adding them to the registration error path to ensure proper synchronization and cleanup.
Affected products
- Linux Linux Kernel All versions prior to the fix (specifically affecting thermal core)
Timeline
- 2026-04-07: patched: Initial patch authored by Rafael J. Wysocki
- 2026-05-27: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/37a430a2d4e66ec8238da6c7f7e48809bf265e13
- https://git.kernel.org/stable/c/41ff66baf81c6541f4f985dd7eac4494d03d9440
- https://git.kernel.org/stable/c/64d4ebf91d082034bbc5ae3ba2d7fd800bc02d06
- https://git.kernel.org/stable/c/75f8f3c3e09122270986de9d7aa347d701676761
- https://git.kernel.org/stable/c/f412e541d25a3dfaf3d53e012ade6ff03cae8a45