CVE-2026-97475 thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
A use-after-free vulnerability in the Linux kernel Tegra thermal driver allows attackers to cause denial of service or execute code via improper cooling device cleanup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97475?
CVE-2026-97475 is an use after free vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
Use devm_thermal_of_cooling_device_register() to simplify resource management and avoid manual cleanup in error paths.
As a side effect this change has the benefit of solving an existing issue. Before, the function tegra_soctherm_remove() only called debugfs_remove_recursive() and never called thermal_cooling_device_unregister() for any of the cooling devices registered here.
After the driver removal, the thermal framework's cdev list would still hold references to thermal_cooling_device objects whose devdata pointer (ts) pointed to memory already freed by the platform device's devm cleanup.
With this change, the cooling device is unregistered when the driver is removed, thus fixing the issue above.
Which versions are affected by CVE-2026-97475?
How do I fix CVE-2026-97475?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-97475 being exploited?
There is no known exploitation of CVE-2026-97475 in the wild and no public exploit code.
Sources
Also known as AZL-103833, BELL-CVE-2026-97475, DEBIAN-CVE-2026-97475, GHSA-h37f-mp75-vxqv, UBUNTU-CVE-2026-97475.