CVE-2026-90178

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (coretemp) Fix core_data leak on CPUs without PTS

pdata->core_data is allocated in init_temp_data() when the first core

temp_data of a package is created, but it is only released from

destroy_temp_data(), and only in the branch that handles the package

temp_data.

Package temp_data is created solely when the CPU supports

X86_FEATURE_PTS. On a CPU without it, coretemp_cpu_online() never calls

coretemp_add_core() with pkg_flag set, so pdata->pkg_data stays NULL.

coretemp_cpu_offline() then skips the removal of the package interface,

destroy_temp_data() is never called for package data, and the array is

still allocated when coretemp_device_remove() frees the platform data

that pointed at it.

Release the array in coretemp_device_remove(). destroy_temp_data() sets

pdata->core_data to NULL when it frees it, so the added kfree() is a

no-op on CPUs that do have PTS.

Tested on an Intel Core i5-1135G7. The driver was

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References