CVE-2026-90178: hwmon: (coretemp) Fix core_data leak on CPUs without PTS
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (coretemp) Fix coredata leak on CPUs without PTS
pdata->coredata is allocated in inittempdata() when the first core tempdata of a package is created, but it is only released from destroytempdata(), and only in the branch that handles the package tempdata.
Package tempdata is created solely when the CPU supports X86FEATUREPTS. On a CPU without it, coretempcpuonline() never calls coretempaddcore() with pkgflag set, so pdata->pkgdata stays NULL. coretempcpuoffline() then skips the removal of the package interface, destroytempdata() is never called for package data, and the array is still allocated when coretempdeviceremove() frees the platform data that pointed at it.
Release the array in coretempdeviceremove(). destroytempdata() sets pdata->coredata to NULL when it frees it, so the added kfree() is a no-op on CPUs that do have PTS.
Tested on an Intel Core i5-1135G7. The driver was instrumented to log every allocation and release of pdata->coredata, and the PTS check in coretempcpuonline() was patched out to emulate a CPU without package thermal support. Without this change the array was allocated and never released, and coretempdeviceremove() still saw a non-NULL pointer. With it the array is released and the pointer accounting balances. On an unmodified build the release still happens via the package tempdata and the added kfree() sees NULL, with no slab warnings over repeated module load and unload cycles.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this memory leak?
Systems using the Linux kernel coretemp driver on CPUs that do not support X86_FEATURE_PTS are affected. On these CPUs, package temperature data is not created, leaving the allocated core_data array unreleased during device removal.
When does the unreleased allocation occur?
The allocation is made when temperature data for the first core in a package is created. It remains allocated when the coretemp device is removed because the package-data cleanup path is skipped on CPUs without PTS.
Does the added cleanup change behavior on CPUs with package thermal support?
No. On CPUs with PTS, the existing cleanup path frees core_data and sets its pointer to NULL, so the additional free in device removal is a no-op.