PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46021 Linux CVE debrief

This CVE addresses two related vulnerabilities in the Linux kernel thermal management subsystem. The first issue involves a memory leak that occurs when thermal_zone_device_register_with_trips() fails after adding a thermal governor to a thermal zone—the governor is not properly removed during error cleanup. The second issue is a race condition in thermal_zone_device_unregister(), which calls thermal_set_governor() without holding the thermal zone lock, potentially racing with governor updates via sysfs and leading to use-after-free conditions. The fix adds proper thermal_set_governor() calls in both thermal_release() for cleanup and in the registration error path to handle failures before device registration completes.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Linux system administrators managing thermal-sensitive workloads, kernel maintainers, and security teams monitoring kernel-level memory safety issues

Technical summary

The vulnerability exists in the Linux kernel thermal core subsystem. The first flaw is a memory leak occurring when thermal_zone_device_register_with_trips() fails after governor attachment but before registration completion, leaving the governor reference uncleared. The second flaw is a locking deficiency where thermal_zone_device_unregister() invokes thermal_set_governor() without acquiring the thermal zone mutex, creating a race window with concurrent sysfs governor updates that could result in use-after-free memory corruption. The resolution adds defensive thermal_set_governor() invocations in thermal_release() for proper governor detachment and in the registration error path for pre-registration failure cleanup.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing this thermal subsystem fix
  • Review systems utilizing thermal zone management for unusual memory consumption patterns
  • Ensure thermal governor configurations via sysfs are performed during maintenance windows to minimize race condition exposure

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The fix involves kernel-level changes to thermal zone governor management with commits referenced in the source material. No CVSS score has been assigned as of the CVE publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46021 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46021

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46021 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46021

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/37a430a2d4e66ec8238da6c7f7e48809bf265e13

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/41ff66baf81c6541f4f985dd7eac4494d03d9440

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/64d4ebf91d082034bbc5ae3ba2d7fd800bc02d06

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/75f8f3c3e09122270986de9d7aa347d701676761

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f412e541d25a3dfaf3d53e012ade6ff03cae8a45

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.