Executive brief
The Linux kernel thermal management subsystem contains a use-after-free vulnerability in the hardware monitoring sysfs interface code. A previous cleanup commit inadvertently removed a safety check, allowing the kernel to attempt to free already-freed memory during error handling. An attacker with local system access could exploit this to cause a kernel crash (denial of service) or potentially achieve privilege escalation.
Technical details
A use-after-free vulnerability exists in the thermal_add_hwmon_sysfs() function in drivers/thermal/thermal_hwmon.c. A prior coding-style cleanup commit (030a48b0f6ce) removed a null pointer check before a kfree() call in the error path, allowing the function to attempt to free memory that had already been freed in certain error conditions. The vulnerability affects the thermal subsystem initialization when adding new hardware monitoring devices. An attacker with local access can trigger this code path by inducing thermal device registration failures, leading to kernel memory corruption. The fix involves restoring the removed null check to guard the kfree() operation.
Affected products
- Linux Linux kernel multiple stable versions (exact range not specified in advisory)
Timeline
- 2026-08-22: disclosed: CVE-2026-74604 published
- 2026-08-19: patched: Fix merged in stable kernel trees