The Linux kernel Tegra SoC thermal driver previously failed to unregister its cooling device on removal, leaving dangling references in the thermal framework. When the driver was torn down, the stale pointers pointed to memory that had already been freed by the platform device’s devm cleanup, creating a classic use‑after‑free scenario that could lead to kernel crashes or privileged memory corruption.

All Linux kernel builds that include the Tegra soctherma driver and have not incorporated the commit that switches to devm_thermal_of_cooling_device_register(). The affected releases are unspecified, but any kernel version before the change through the latest patched commit is likely vulnerable.

The CVSS score of 5.5 indicates a moderate severity vulnerability. The EPSS score of <1% and the fact that the vulnerability is not listed in the CISA KEV catalog indicate that it has not yet been widely exploited in the wild. The likely attack vector requires local privileged access or the ability to load and unload kernel modules on a Tegra platform. An attacker with such access could trigger a kernel panic by forcibly removing the driver or otherwise manipulating the device state.