CVE-2026-97475: thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
In the Linux kernel, the following vulnerability has been resolved:
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
Use devmthermalofcoolingdeviceregister() to simplify resource management and avoid manual cleanup in error paths.
As a side effect this change has the benefit of solving an existing issue. Before, the function tegrasocthermremove() only called debugfsremoverecursive() and never called thermalcoolingdeviceunregister() for any of the cooling devices registered here.
After the driver removal, the thermal framework's cdev list would still hold references to thermalcoolingdevice objects whose devdata pointer (ts) pointed to memory already freed by the platform device's devm cleanup.
With this change, the cooling device is unregistered when the driver is removed, thus fixing the issue above.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Tegra SoC thermal driver are exposed when that driver is removed after registering its thermal cooling devices. The issue is specific to the driver-removal lifecycle rather than normal thermal operation alone.
What condition is required to trigger the stale references?
The Tegra soctherm platform driver must be removed. Before the fix, removal freed the driver's device-managed memory without unregistering its thermal cooling devices, leaving the thermal framework with references whose devdata pointer targeted freed memory.
How can I determine whether a system has been affected?
The described affected state exists after removal of the Tegra soctherm driver if cooling devices had been registered: the thermal framework's cooling-device list can retain entries referencing freed driver data. The provided data does not specify a user-visible log message or diagnostic command for confirming this state.
What does the fix change?
The fix replaces manual cooling-device registration with device-managed cooling-device registration. This causes cooling devices to be unregistered during driver removal, preventing stale thermal-framework references to freed memory.