CVE-2026-46021: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46021 Overview

CVE-2026-46021 is a Linux kernel vulnerability in the thermal core subsystem. The flaw involves improper cleanup of thermal zone governors during failed registration and unregistration paths. Two distinct issues are addressed: a memory leak when thermal_zone_device_register_with_trips() fails after a governor has been attached, and a use-after-free condition in thermal_zone_device_unregister() caused by calling thermal_set_governor() without holding the thermal zone lock. The unlocked call can race with sysfs-driven governor updates, leading to memory corruption.

Critical Impact
A race condition between governor unregistration and concurrent sysfs governor updates can trigger a use-after-free in the Linux kernel thermal core, with secondary memory leak exposure on registration failure paths.

Affected Products

Linux kernel (thermal core subsystem)
Distributions shipping unpatched stable kernel branches referenced by the upstream fix commits
Systems exposing thermal governor controls via sysfs

Discovery Timeline

2026-05-27 - CVE-2026-46021 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46021

Vulnerability Analysis

The Linux kernel thermal core manages thermal zones, each associated with a governor that decides how to respond to trip-point crossings. The vulnerability arises from two cleanup defects in this lifecycle.

First, when thermal_zone_device_register_with_trips() fails after a governor has already been bound to the zone, the governor reference is not released. This produces a memory leak on every failed registration that progressed past governor attachment.

Second, thermal_zone_device_unregister() invokes thermal_set_governor() without first acquiring the thermal zone lock. A concurrent sysfs write changing the active governor can run in parallel. The resulting race may free or replace the governor structure while another path still references it, yielding a use-after-free [CWE-416].

Root Cause

The root cause is missing synchronization and missing cleanup symmetry. The registration error path lacks a corresponding thermal_set_governor() call to detach the governor on failure. The unregistration path performs governor teardown without the thermal zone lock that protects governor state against sysfs updates.

Attack Vector

Exploitation requires local access to the system and the ability to write to thermal sysfs entries such as policy under /sys/class/thermal/thermal_zone*/. An attacker triggers or waits for a thermal zone unregister event and races it with a governor change to dereference freed memory. The memory leak component does not require a race but does require triggering a failure inside the registration path.

No verified public exploit code is available. The upstream fix adds two thermal_set_governor() calls: one in thermal_release() to remove the governor on teardown, and one in the registration error path to cover failures preceding device registration. See the upstream commits at Kernel Git Commit 37a430a and Kernel Git Commit f412e5 for technical details.

Detection Methods for CVE-2026-46021

Indicators of Compromise

Kernel oops or KASAN reports referencing thermal_set_governor, thermal_zone_device_unregister, or thermal_release in the call stack
Unexplained slab corruption warnings tied to thermal_governor allocations
kmemleak reports identifying unreleased thermal governor objects after probe failures of thermal drivers

Detection Strategies

Enable KASAN and kmemleak on test kernels to surface the use-after-free and leak signatures during stress testing
Audit kernel logs for thermal subsystem errors correlated with sysfs writes to /sys/class/thermal/thermal_zone*/policy
Track loaded kernel versions across the fleet and flag hosts running builds that predate the upstream fix commits

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on thermal-subsystem oops, BUG, or KASAN entries
Monitor for unusual write activity to thermal sysfs governor controls from non-administrative processes
Track thermal driver module load and unload events that could trigger the unregister path

How to Mitigate CVE-2026-46021

Immediate Actions Required

Apply the upstream stable kernel updates referenced by the fix commits as soon as they are available in your distribution
Inventory hosts that load thermal drivers and prioritize patching systems where local users have shell access
Restrict write access to thermal sysfs nodes to root-only contexts and avoid granting CAP_SYS_ADMIN to untrusted workloads

Patch Information

The fix is delivered through the following upstream commits, which add the missing thermal_set_governor() calls in both the registration error path and thermal_release():

Consult your distribution security tracker to identify backported package versions.

Workarounds

Tighten permissions on /sys/class/thermal/thermal_zone*/policy to prevent non-root processes from changing governors
Avoid runtime unloading of thermal driver modules on production systems until the patched kernel is deployed
Where feasible, pin a single thermal governor at boot and disable userspace governor changes through configuration management

bash

# Restrict write access to thermal governor sysfs controls
for f in /sys/class/thermal/thermal_zone*/policy; do
    chmod 0600 "$f"
done

# Verify running kernel version against your distribution's patched build
uname -r