CVE-2026-93142: thermal/drivers/rcar: Fix error checking in probe()
In the Linux kernel, the following vulnerability has been resolved:
thermal/drivers/rcar: Fix error checking in probe()
This code accidentally calls thermalzonedeviceenable() before checking whether thermalzonedeviceregisterwithtrips() failed. Move the call until later to avoid an error pointer dereference of "priv->zone".
The driver works differently depending on if we are using OF thermal or not. We use thermaladdhwmonsysfs() if we are using OF thermal and call thermalzonedeviceenable() if not. We can share same error check for if either of these fail.
Moving the thermalzonedeviceenable() call is a bit cleaner as well. The original code used a three step process to cleanup: 1. Call thermalzonedeviceunregister() to cleanup. 2. Set priv->zone to an error pointer to preserve the error code. 3. Set priv->zone to NULL to avoid a second call to thermalzonedeviceunregister() in the rcarthermalremove() function.
Now we can just do a direct goto errorunregister and rcarthermalremove() handles the cleanup properly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel rcar thermal driver's probe() error path, check whether thermal_zone_device_register_with_trips() failed before calling thermal_zone_device_enable(); on failure, go to error_unregister and call thermal_zone_device_unregister() for cleanup, setting priv->zone to NULL afterward to prevent a second unregister call.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems that load the Linux kernel R-Car thermal driver are exposed during the driver probe path when thermal-zone registration fails. The provided information does not identify affected kernel versions or specific hardware models.
What condition is required to trigger the fault?
Thermal zone registration must fail, leaving priv->zone as an error pointer. In the affected ordering, the driver then calls thermal_zone_device_enable() before checking that failure, which can dereference the error pointer.
Does the behavior differ between OF thermal and non-OF thermal configurations?
Yes. With OF thermal, the driver uses thermal_add_hwmon_sysfs(); without OF thermal, it calls thermal_zone_device_enable(). The fix ensures failures from either path use shared error handling after validating thermal-zone registration.
How can administrators determine whether they are affected?
Review the kernel source or applied stable patches for the referenced fixes and verify that thermal_zone_device_enable() is called only after successful thermal_zone_device_register_with_trips() handling. The supplied data does not provide a runtime detection method or affected-version list.