UBUNTU-CVE-2026-90178: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix coredata leak on CPUs without PTS pdata->coredata is allocated in inittempdata() when the first core tempdata of a package is created, but it is only released from destroytempdata(), and only in the branch that handles the package tempdata. Package tempdata is created solely when the CPU supports X86FEATUREPTS. On a CPU without it, coretempcpuonline() never calls coretempaddcore() with pkgflag set, so pdata->pkgdata stays NULL. coretempcpuoffline() then skips the removal of the package interface, destroytempdata() is never called for package data, and the array is still allocated when coretempdeviceremove() frees the platform data that pointed at it. Release the array in coretempdeviceremove(). destroytempdata() sets pdata->coredata to NULL when it frees it, so the added kfree() is a no-op on CPUs that do have PTS. Tested on an Intel Core i5-1135G7. The driver was instrumented to log every allocation and release of pdata->coredata, and the PTS check in coretempcpuonline() was patched out to emulate a CPU without package thermal support. Without this change the array was allocated and never released, and coretempdeviceremove() still saw a non-NULL pointer. With it the array is released and the pointer accounting balances. On an unmodified build the release still happens via the package tempdata and the added kfree() sees NULL, with no slab warnings over repeated module load and unload cycles.