CVE-2026-93142: thermal/drivers/rcar: Fix error checking in probe()
In the Linux kernel, the following vulnerability has been resolved:
thermal/drivers/rcar: Fix error checking in probe()
This code accidentally calls thermalzonedeviceenable() before checking whether thermalzonedeviceregisterwithtrips() failed. Move the call until later to avoid an error pointer dereference of "priv->zone".
The driver works differently depending on if we are using OF thermal or not. We use thermaladdhwmonsysfs() if we are using OF thermal and call thermalzonedeviceenable() if not. We can share same error check for if either of these fail.
Moving the thermalzonedeviceenable() call is a bit cleaner as well. The original code used a three step process to cleanup: 1. Call thermalzonedeviceunregister() to cleanup. 2. Set priv->zone to an error pointer to preserve the error code. 3. Set priv->zone to NULL to avoid a second call to thermalzonedeviceunregister() in the rcarthermalremove() function.
Now we can just do a direct goto errorunregister and rcarthermalremove() handles the cleanup properly.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In thermal/drivers/rcar, fix error handling in probe(): ensure thermal_zone_device_enable() is not called before checking whether thermal_zone_device_register_with_trips() failed; reuse a shared error check and branch the enabling logic so it only runs after registration succeeds (use thermal_add_hwmon_sysfs() for OF thermal, and thermal_zone_device_enable() for non-OF).
Linux kernel (thermal/drivers/rcar: rcar_thermal) probe() error checking = Move thermal_zone_device_enable() call until after successful thermal_zone_device_register_with_trips() check - Configuration
During rcar_thermal_remove() cleanup flow, set priv->zone to NULL to avoid a second call to thermal_zone_device_unregister(), or set priv->zone to an error pointer to preserve the error code until cleanup; move the goto target (e.g., goto error_unregister and rcar_thermal_remove()) so thermal_zone_device_unregister() cleanup happens correctly and avoids error-pointer dereference.
Linux kernel (thermal/drivers/rcar: rcar_thermal) priv->zone initialization = Set priv->zone to NULL / error pointer as appropriate to avoid double cleanup and preserve error code - Compensating control
During rcar_thermal_probe() failure paths, ensure the driver cleanup properly unregisters via thermal_zone_device_unregister() (via goto error_unregister / rcar_thermal_remove()) and does not dereference an error pointer for priv->zone.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems that load the Linux kernel R-Car thermal driver are exposed during the driver probe path when thermal-zone registration fails. The provided information does not identify affected kernel versions or specific hardware models.
What condition is required to trigger the fault?
Thermal zone registration must fail, leaving priv->zone as an error pointer. In the affected ordering, the driver then calls thermal_zone_device_enable() before checking that failure, which can dereference the error pointer.
Does the behavior differ between OF thermal and non-OF thermal configurations?
Yes. With OF thermal, the driver uses thermal_add_hwmon_sysfs(); without OF thermal, it calls thermal_zone_device_enable(). The fix ensures failures from either path use shared error handling after validating thermal-zone registration.
How can administrators determine whether they are affected?
Review the kernel source or applied stable patches for the referenced fixes and verify that thermal_zone_device_enable() is called only after successful thermal_zone_device_register_with_trips() handling. The supplied data does not provide a runtime detection method or affected-version list.