CVE-2026-74604

Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

Published Aug 22, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

Revert commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style
a bit") that introduced a use-after-free into the error path of
thermal_add_hwmon_sysfs() by removing a valid check from it.

Analysis

Technical impact

A use‑after‑free flaw was introduced in the Linux kernel’s thermal_add_hwmon_sysfs function when a validity check was removed during a commit cleanup. On the error path, the missing check allows an attacker with local or physical access to trigger kernel memory corruption. The resulting corruption can lead to kernel‑level privilege escalation or system instability.

Affected Systems

All Linux kernel releases that contain commit 030a48b0f6ce and have not yet incorporated the revert. Kernel versions newer than the fix contain the revert commit, restoring the required validity check and eliminating the vulnerability.

Risk and Exploitability

The CVSS score of 8.4 indicates a high‑severity local vulnerability, while an EPSS score of < 1% shows a low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require local or physical access to exercise the error path, but once achieved it could allow an attacker to gain kernel privileges or crash the system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< 2434f4765da8ccd7ef31be88b86f1bfa2e95be11
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< b4c01ae6dd56d9dfd96bd1b29c28afa8fa06b366
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< 999e573212d5f1debf073c68be35e55bbfad12fc
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< 6a48ee9a5bda0f8ee501f9bef159fb9f39ff519a
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< 8d34019d1413629a434a7e8d9f91c76d256196a0
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< 6b446d335ba16e93a266dd77adf1ba51abc82df4
`030a48b0f6ce393d78b8d33debb1e2043b8cc156`	affected	< ff8da20b6f47c48d46e47f93f7a59e2d56ee9107

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2434f4765da8ccd7ef31be88b86f1bfa2e95be11)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b4c01ae6dd56d9dfd96bd1b29c28afa8fa06b366)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,999e573212d5f1debf073c68be35e55bbfad12fc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6a48ee9a5bda0f8ee501f9bef159fb9f39ff519a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8d34019d1413629a434a7e8d9f91c76d256196a0)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6b446d335ba16e93a266dd77adf1ba51abc82df4)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ff8da20b6f47c48d46e47f93f7a59e2d56ee9107)`	affected	code_commit	—
`[0,5.15.216)`	affected	semver	—
`[0,6.1.183)`	affected	semver	—
`[0,6.6.152)`	affected	semver	—
`[0,6.12.104)`	affected	semver	—
`[0,6.18.45)`	affected	semver	—
`[0,7.1.9)`	affected	semver	—
`[0,7.2)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the revert commit that restores the missing validity check.
If an upgrade is not possible, disable the thermal_hwmon subsystem, or remove the related kernel module from the initramfs to eliminate the exploitation surface.
Apply kernel hardening such as KASLR, page‑fault protection, stack and address‑space randomization, and reduce the permissions on /sys/class/hwmon to limit local exploitation attempts.

Generated by OpenCVE AI on August 25, 2026 at 15:50 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.138% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/2434f4765da8ccd7ef31be88b86f1bfa2e95be11
https://git.kernel.org/stable/c/6a48ee9a5bda0f8ee501f9bef159fb9f39ff519a
https://git.kernel.org/stable/c/6b446d335ba16e93a266dd77adf1ba51abc82df4
https://git.kernel.org/stable/c/8d34019d1413629a434a7e8d9f91c76d256196a0
https://git.kernel.org/stable/c/999e573212d5f1debf073c68be35e55bbfad12fc
https://git.kernel.org/stable/c/b4c01ae6dd56d9dfd96bd1b29c28afa8fa06b366
https://git.kernel.org/stable/c/ff8da20b6f47c48d46e47f93f7a59e2d56ee9107
https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74604-c7bc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74604
https://www.cve.org/CVERecord?id=CVE-2026-74604

History

Oct 17, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 2:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74604-c7bc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74604 https://www.cve.org/CVERecord?id=CVE-2026-74604
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 11:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 25, 2026 9:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Aug 25, 2026 5:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 5:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit") that introduced a use-after-free into the error path of thermal_add_hwmon_sysfs() by removing a valid check from it.
Title		Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2434f4765da8ccd7ef31be88b86f1bfa2e95be11 https://git.kernel.org/stable/c/6a48ee9a5bda0f8ee501f9bef159fb9f39ff519a https://git.kernel.org/stable/c/6b446d335ba16e93a266dd77adf1ba51abc82df4 https://git.kernel.org/stable/c/8d34019d1413629a434a7e8d9f91c76d256196a0 https://git.kernel.org/stable/c/999e573212d5f1debf073c68be35e55bbfad12fc https://git.kernel.org/stable/c/b4c01ae6dd56d9dfd96bd1b29c28afa8fa06b366 https://git.kernel.org/stable/c/ff8da20b6f47c48d46e47f93f7a59e2d56ee9107