CVE-2026-97475 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, especially those using affected thermal drivers, should assess exposure and prioritize verification of Linux kernel versions. They must consider potential issues with thermal framework's cdev list and ensure proper resource management to avoid similar vulnerabilities.

Why it matters

Defenders should assess exposure and prioritize verification of Linux kernel versions, especially those using affected thermal drivers, as the vulnerability could lead to issues with thermal framework's cdev list.

• Verification of Linux kernel versions is required to determine exposure
• Defenders must assess thermal driver configurations for potential issues
• Monitoring for updates on affected versions is necessary

Technical summary

The Linux kernel vulnerability was resolved by switching to devm cooling device registration. This change simplifies resource management and avoids manual cleanup in error paths, fixing an existing issue with thermal framework's cdev list holding references to thermal_cooling_device objects whose devdata pointer pointed to memory already freed. The vulnerability affects Linux kernel systems using the thermal drivers, and defenders should assess exposure and prioritize verification of Linux kernel versions, especially those using affected thermal drivers.

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel versions, especially those using the affected thermal drivers.

Recommended defensive actions

• Assess Linux kernel versions for exposure
• Verify thermal driver configurations
• Monitor for updates on affected versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution. However, the corpus does not establish specific affected versions or exploitation details, requiring verification from official sources. Linux kernel versions and thermal driver configurations must be assessed for exposure. Official sources should be consulted for accurate information on affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.