CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues
In the Linux kernel, the following vulnerability has been resolved:
thermal: core: Fix thermal zone governor cleanup issues
If thermalzonedeviceregisterwithtrips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak.
In turn, thermalzonedeviceunregister() calls thermalsetgovernor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case.
Address these issues by adding two thermalsetgovernor() calls, one to thermalrelease() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What conditions are needed for the use-after-free to occur?
The issue is relevant where thermal zones can be registered or unregistered while their governors may be changed through sysfs. The unsafe path is a race between thermal_zone_device_unregister() and a sysfs-driven governor update; a failed thermal-zone registration can also leave a governor attached and leak memory.
What level of access does an attacker need?
Exploitation requires local access with low privileges according to the supplied CVSS vector. No user interaction is required, but the attack complexity is rated high because the governor update must race with thermal-zone cleanup.
Which products and versions are identified as affected?
The supplied affected software list includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. The description does not provide a complete affected-version range or a fixed-version number.