CVE-2026-74604 Overview
CVE-2026-74604 is a use-after-free vulnerability in the Linux kernel's thermal hardware monitoring subsystem. The flaw resides in the error path of thermal_add_hwmon_sysfs(), where a prior cleanup commit (030a48b0f6ce — "thermal/drivers/hwmon: Cleanup coding style a bit") removed a valid check. Maintainers resolved the issue by reverting that commit. A local attacker with the ability to trigger the error path can dereference freed memory in kernel context, potentially leading to privilege escalation, kernel memory corruption, or a system crash.
Critical Impact
Local use-after-free in the Linux kernel thermal/hwmon driver can compromise kernel confidentiality, integrity, and availability.
Affected Products
- Linux kernel versions containing commit 030a48b0f6ce in drivers/thermal/thermal_hwmon.c
- Distributions shipping affected stable kernel branches prior to the revert
- Systems exposing the thermal HWMON sysfs interface
Discovery Timeline
- 2026-08-22 - CVE-2026-74604 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74604
Vulnerability Analysis
The Linux kernel thermal framework exposes temperature sensors through the hardware monitoring (hwmon) sysfs interface using thermal_add_hwmon_sysfs(). The upstream cleanup commit 030a48b0f6ce removed a validity check on the error path, causing the function to reference an object after it was released. When registration fails, the cleanup logic frees an internal structure but later code paths continue to access it, satisfying the classic use-after-free pattern [CWE-416].
Because the affected code runs in kernel mode, exploitation can corrupt adjacent kernel objects. An attacker with local access can trigger the error path to reclaim the freed allocation with attacker-controlled data, then coerce the kernel into using the stale pointer. This provides a primitive for kernel memory disclosure or write-what-where escalation.
Root Cause
The root cause is the removal of a valid sanity check during a code-style cleanup. Without the check, the failure path in thermal_add_hwmon_sysfs() proceeds to use a structure that has already been freed by the error handling logic. The fix reverts commit 030a48b0f6ce, restoring the original check and eliminating the dangling reference.
Attack Vector
Exploitation requires local access. An attacker with the ability to load a thermal driver, register a thermal zone, or otherwise force thermal_add_hwmon_sysfs() down its error path can trigger the free-and-reuse sequence. No user interaction is required, and the flaw executes entirely within kernel context.
No public proof-of-concept exploit is currently associated with this CVE. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the kernel.org stable commit for the revert and related backports for technical details.
Detection Methods for CVE-2026-74604
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing thermal_hwmon, thermal_add_hwmon_sysfs, or hwmon_device_register
- KASAN reports flagging use-after-free in the thermal subsystem on instrumented kernels
- Repeated failed thermal zone registrations from unprivileged processes
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface use-after-free access in drivers/thermal/thermal_hwmon.c
- Compare running kernel build IDs and package versions against distribution advisories that include the revert commit
- Audit loaded kernel modules that register thermal zones for driver initialization failures in dmesg
Monitoring Recommendations
- Forward dmesg, journald, and kernel crash dumps to a central log store and alert on stack traces containing thermal_add_hwmon_sysfs
- Track kernel package versions across the fleet and flag hosts running unpatched stable branches
- Monitor /sys/class/thermal/ interactions and thermal driver load events for anomalous local activity
How to Mitigate CVE-2026-74604
Immediate Actions Required
- Apply the vendor kernel update that reverts commit 030a48b0f6ce on every affected host
- Reboot systems after patching to load the corrected kernel image
- Restrict local shell access and audit accounts with the ability to load kernel modules or interact with thermal sysfs entries
Patch Information
The fix reverts commit 030a48b0f6ce and has been backported across stable branches. Reference commits: 2434f47, 6a48ee9, 6b446d3, 8d34019, 999e573, b4c01ae, and ff8da20. Consume the fix through your distribution's kernel update channel.
Workarounds
- Reduce local attack surface by limiting shell access to trusted administrators until patching is complete
- Where feasible, unload or blacklist thermal drivers that are not required on the host
- Enforce module signing and lockdown mode to prevent unprivileged module loading that could reach the affected path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
