CVE-2026-74604

A flaw was found in the Linux kernel's thermal/drivers/hwmon component. A use-after-free vulnerability was introduced in the thermal_add_hwmon_sysfs() function due to the removal of a valid check in an error handling path. This flaw could allow a local attacker to cause a denial of service or potentially escalate privileges.

thermal_add_hwmon_sysfs() could free an existing shared hwmon object on an error path instead of freeing only a newly allocated object. This creates a use-after-free candidate because the object may still be reachable from thermal or hwmon state after the failed setup path returns. For the CVSS the PR:H because triggering normally requires local ability to influence thermal device registration or driver setup and this control may be available to a privileged service or user only. Impact is at least local denial of service via kernel crash, and in the worst case may allow confidentiality or integrity impact due to kernel memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.