Executive brief
The Linux kernel's Intel thermal management driver (int3400) has a resource cleanup issue during driver initialization failures. If certain setup steps fail after creating sysfs files, those files and their associated memory are not properly cleaned up, potentially leaving stale device files and wasting system memory.
Technical details
The vulnerability is a resource leak in the int3400_thermal.c driver's probe error path. The evaluate_odvp() function creates per-ODVP (OEM-defined vendor variables) sysfs files and allocates associated storage before the thermal zone device is registered. The original cleanup path only called cleanup_odvp() from a late sysfs failure label, so failures occurring after evaluate_odvp() but before that label (such as thermal_tripless_zone_device_register() failures) would leave orphaned sysfs files and memory unreleased. The fix relocates the cleanup_odvp() call to the common ART/TRT unwind path to ensure cleanup occurs regardless of where the probe fails, and also clears cached ODVP pointers to prevent use-after-free during partial setup failures.
Affected products
- Linux Linux kernel Affected versions across multiple stable and rolling branches
Timeline
- 2026-09-17: disclosed: CVE-2026-92504 published
- 2026-06-23: patched: Upstream fix committed by Pengpeng Hou
- 2026-09-14: patched: Backported to stable kernels