PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45925 Linux CVE debrief

A reference-count leak in the Linux kernel's thermal subsystem could allow gradual memory exhaustion on affected systems. The vulnerability exists in thermal_of_cm_lookup(), where a device tree node obtained via of_parse_phandle() was not properly released. The fix applies the __free(device_node) cleanup attribute to ensure automatic deallocation. This is a local issue requiring no authentication; while no CVSS score has been assigned, reference leaks in kernel code paths can contribute to resource exhaustion over time. Multiple stable kernel branches have received patches. No evidence of active exploitation or ransomware use has been reported.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators managing bare-metal or virtualized workloads with thermal zone configurations; kernel maintainers backporting stable patches; security teams tracking kernel memory integrity

Technical summary

The thermal_of_cm_lookup() function in drivers/thermal/of-thermal.c acquires a device_node pointer via of_parse_phandle() but fails to release it, causing a reference count leak. The fix introduces the __free(device_node) cleanup attribute to ensure automatic deallocation when the function scope exits. This pattern prevents cumulative memory consumption during thermal zone lookups. The vulnerability is local and requires no privileges to trigger the code path, though practical impact depends on thermal configuration lookup frequency.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the referenced stable commits
  • Monitor NVD for CVSS assignment and CPE criteria to refine prioritization
  • Review thermal subsystem configurations if running custom kernel builds
  • Track memory usage patterns on systems with thermal zone configurations as a detection heuristic

Evidence notes

The vulnerability description confirms a reference leak in thermal_of_cm_lookup() where tr_np from of_parse_phandle() was never released. The resolution uses the __free(device_node) cleanup attribute for automatic release. Four stable kernel commits are referenced, indicating backports to multiple supported branches. The CVE was published 2026-05-27 and modified same day. NVD status is 'Awaiting Analysis' with no CVSS vector or CPE criteria assigned. No KEV entry exists.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45925 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45925

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45925 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45925

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/025796ccd7f9f2e013e12319de26b6c021a80c1f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8344d5da9df74fdbef676214d0c482fc822a01ca

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8af710156c53cdb392d529497ef2b3a10a1f9370

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a1fe789a96fe47733c133134fd264cb7ca832395

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.