CVE-2026-92504 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
thermal: intel: int3400: clean up ODVP on probe failures
evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The current unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp() but before that label, including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind.
Move the ODVP cleanup to the common ART/TRT unwind path so every failure after evaluate_odvp() releases the ODVP state. Also clear the cached ODVP pointers in cleanup_odvp(), because evaluate_odvp() can already call it for partial setup failures while probe continues.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within the Linux kernel's thermal management subsystem, specifically affecting the Intel int3400 driver, stems from an improper resource allocation and deallocation sequence during device initialization. The core issue lies in the evaluate_odvp function, which is responsible for setting up Over-Voltage Protection (ODVP) features by creating per-ODVP sysfs files before the thermal zone and other probe resources are fully registered. This early creation of user-facing interface elements introduces a race condition window where system stability can be compromised if subsequent initialization steps fail. The existing error handling logic, or unwind path, was incomplete because it only invoked the cleanup_odvp function from a late-stage sysfs failure path. Consequently, any errors occurring after evaluate_odvp but before reaching that specific label resulted in orphaned resources being left behind in the system state.
This resource leak manifests primarily when functions such as thermal_tripless_zone_device_register fail during the probe process. In these scenarios, while the driver attempts to abort initialization due to a critical error, it fails to release the ODVP files and associated storage structures that were allocated earlier. This leads to memory leaks and potential dangling pointers within the kernel space. Over time, repeated occurrences of this flaw can contribute to resource exhaustion on systems with multiple thermal zones or frequent hot-plug events. Furthermore, leaving sysfs entries in an inconsistent state where they reference freed or invalid internal data structures poses a risk for undefined behavior if user-space applications attempt to interact with these orphaned interfaces, potentially leading to kernel panics or information disclosure vulnerabilities depending on how the stale pointers are accessed later.
From a security and standards perspective, this flaw aligns with CWE-401, which describes missing release of memory after effective allocation, as well as CWE-755, concerning improper handling of unusual input situations during error conditions where cleanup is skipped. In terms of attack surface reduction, mitigating such resource leaks prevents attackers from leveraging accumulated kernel memory artifacts to potentially destabilize the system or exhaust available resources for denial-of-service purposes. The vulnerability also touches upon robustness principles found in secure coding standards that mandate consistent state management regardless of execution path success or failure. By ensuring that every exit point properly cleans up allocated resources, the integrity and reliability of the thermal subsystem are significantly enhanced.
The resolution involves restructuring the error handling logic to move the ODVP cleanup routine into a common unwind path shared with ART (Active Thermal Control) and TRT (Thermal Resolution Table) teardown operations. This ensures that any failure occurring after evaluate_odvp triggers the release of ODVP state, thereby eliminating the window where resources are left orphaned. Additionally, the fix includes clearing cached ODVP pointers within cleanup_odvp to prevent use-after-free scenarios if the function is called during partial setup failures while the probe continues or restarts. This comprehensive approach guarantees that all allocated memory and sysfs entries associated with ODVP are properly released upon any initialization failure, maintaining a clean kernel state and preventing potential exploitation vectors related to resource management errors in the thermal driver infrastructure.