CVE-2026-45925: thermal/of: Fix reference leak in thermal_of_cm_lookup()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-06-25

Description

In the Linux kernel, the following vulnerability has been resolved: thermal/of: Fix reference leak in thermal_of_cm_lookup() In thermal_of_cm_lookup(), tr_np is obtained via of_parse_phandle(), but never released. Use the __free(device_node) cleanup attribute to automatically release the node and fix the leak. [ rjw: Changelog edits ]

Affected products

Linux kernel: from 6.12.18 before 6.12.75; from 6.13.6 before 6.14; from 6.14.1 before 6.18.14; from 6.19 before 6.19.4; 6.14, 6.14-rc5, 6.14-rc6, 6.14-rc7 — fixed in 6.12.75, 6.14, 6.18.14, 6.19.4

How to fix

Upgrade to a fixed version: Linux kernel 6.12.75, 6.14, 6.18.14, 6.19.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-45925 or the next vulnerability affects your stack