Linux Kernel EUVD-2026-32402

The Linux kernel thermal management subsystem (drivers/thermal/thermal_core.c) manages thermal zones - abstract representations of hardware temperature sensors - paired with thermal governors (control algorithms such as 'step_wise' or 'power_allocator') and trip points. Thermal zone lifecycle is managed via thermal_zone_device_register_with_trips() for registration and thermal_zone_device_unregister() for removal. The governor attachment and detachment function, thermal_set_governor(), modifies shared state and must be called while holding the thermal zone lock to prevent concurrent access. CWE-401 (Missing Release of Memory after Effective Lifetime) manifests in the registration error path: when thermal_zone_device_register_with_trips() fails after a governor has already been attached, it does not call thermal_set_governor(NULL) to detach and free the governor reference, leaving orphaned memory. The race condition arises because thermal_zone_device_unregister() calls thermal_set_governor() without the zone lock, creating a TOCTOU window where a concurrent write to the sysfs governor attribute (e.g., /sys/class/thermal/thermal_zoneN/policy) can modify the governor pointer concurrently, resulting in a use-after-free dereference. The fix introduces thermal_set_governor() calls in both thermal_release() and the registration error path to close both gaps. Affected CPE: cpe:2.3:o:linux:linux_kernel across multiple version branches back to approximately kernel 4.2 per EUVD data.