CVE-2026-45925: Linux Kernel Reference Leak Vulnerability

CVE-2026-45925 Overview

CVE-2026-45925 is a memory leak vulnerability in the Linux kernel thermal subsystem. The flaw resides in thermal_of_cm_lookup(), where the tr_np device node reference obtained via of_parse_phandle() is never released. Each invocation leaks a device_node reference, gradually depleting kernel resources. The upstream fix applies the __free(device_node) cleanup attribute to automatically release the node when it leaves scope.

Critical Impact
Repeated invocations of the affected path leak device node references, contributing to long-term kernel resource exhaustion on systems exercising the thermal Open Firmware (OF) cooling map lookup.

Affected Products

Linux kernel (mainline) prior to the commits referenced in the upstream fix
Stable Linux kernel branches receiving backports identified by commits 025796c, 8344d5d, 8af7101, and a1fe789
Distributions packaging affected Linux kernel versions with the thermal/of driver enabled

Discovery Timeline

2026-05-27 - CVE-2026-45925 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45925

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the device tree (DT) thermal cooling map lookup logic. The thermal_of_cm_lookup() function calls of_parse_phandle() to resolve tr_np, a pointer to a referenced device tree node. The Open Firmware (OF) API increments the reference count on the returned node. Callers must release the reference with of_node_put() once finished. The affected function returned without releasing tr_np, leaking the reference on every successful lookup.

While the leak does not directly expose memory corruption or privilege escalation, sustained leakage of device node references reduces available kernel resources. Long-running systems that repeatedly invoke the thermal OF lookup path can exhibit degraded reliability over time.

Root Cause

The root cause is missing reference counting cleanup. The function obtained a refcounted device node through of_parse_phandle() but lacked the corresponding of_node_put() on all code paths. The fix adopts the scope-based cleanup helper __free(device_node), which invokes the appropriate release function automatically when the variable leaves scope, eliminating the manual cleanup obligation.

Attack Vector

The issue is not directly exploitable for code execution or privilege escalation. Triggering the leak requires the kernel to execute the affected thermal OF cooling map lookup path. On platforms whose device tree describes thermal zones using cooling maps, the leak accumulates across normal thermal management operations. Refer to the upstream commits in Kernel Git Commit 025796c and Kernel Git Commit a1fe789 for the exact source-level change.

Detection Methods for CVE-2026-45925

Indicators of Compromise

No network-observable indicators exist for this local kernel memory leak.
Gradual growth in kernel slab allocations associated with device_node objects on affected hosts.
Long-running systems showing increasing kernel memory consumption without a corresponding workload change.

Detection Strategies

Compare running kernel versions against the patched commits referenced in the Linux stable tree to identify unpatched hosts.
Use vulnerability management tooling to flag systems running Linux kernel builds that predate the fix for CVE-2026-45925.
Inspect /proc/slabinfo and kmemleak reports on debug kernels to identify accumulating device node references.

Monitoring Recommendations

Track kernel memory usage trends on Linux hosts that exercise thermal management on device tree platforms (typically ARM and ARM64).
Alert on unexpected kernel memory growth that correlates with thermal subsystem activity.
Maintain an inventory of kernel package versions across the fleet to accelerate patch validation.

How to Mitigate CVE-2026-45925

Immediate Actions Required

Identify Linux hosts running kernel versions that predate the upstream fix for CVE-2026-45925.
Plan kernel updates for affected systems, prioritizing long-running embedded and server platforms using device tree thermal cooling maps.
Subscribe to distribution security advisories to receive the backported fix when published.

Patch Information

The fix is available in the upstream Linux kernel via commits 025796c, 8344d5d, 8af7101, and a1fe789. The change adopts the __free(device_node) cleanup attribute on tr_np to release the node automatically. Apply the kernel update provided by your Linux distribution once the patched build is released.

Workarounds

No functional workaround exists short of disabling the affected thermal OF cooling map functionality, which is not practical on platforms that depend on it.
Reboot affected hosts on a regular maintenance cadence to reclaim leaked references until the patched kernel is deployed.
Restrict deployment of unpatched kernels to short-lived workloads where cumulative leakage is bounded.

bash

# Verify the running kernel version and compare against patched stable releases
uname -r

# On Debian/Ubuntu, upgrade to the latest patched kernel package
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# On RHEL/Fedora-based systems
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot