CVE-2026-92504 thermal: intel: int3400: clean up ODVP on probe failures
A memory leak in the Intel int3400 thermal driver occurs when probe operations fail, potentially leading to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92504?
CVE-2026-92504 is a high-severity memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thermal: intel: int3400: clean up ODVP on probe failures
evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The current unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp() but before that label, including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind.
Move the ODVP cleanup to the common ART/TRT unwind path so every failure after evaluate_odvp() releases the ODVP state. Also clear the cached ODVP pointers in cleanup_odvp(), because evaluate_odvp() can already call it for partial setup failures while probe continues.
Which versions are affected by CVE-2026-92504?
How do I fix CVE-2026-92504?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-92504 being exploited?
There is no known exploitation of CVE-2026-92504 in the wild and no public exploit code.
Sources
Also known as AZL-101945, BELL-CVE-2026-92504, DEBIAN-CVE-2026-92504, GHSA-jr28-r3rj-w85q, UBUNTU-CVE-2026-92504.