CVE-2026-97475

A flaw was found in the Linux kernel's Tegra SOCTHERM driver. When the driver is removed, registered cooling devices are not unregistered from the thermal framework, leaving stale references to memory that has already been released. This leads to a use-after-free vulnerability, where the system attempts to access deallocated memory. A local attacker could exploit this flaw during device or driver removal to cause a Denial of Service (DoS) via a system crash or potentially achieve arbitrary code execution.

A moderate impact use-after-free flaw was found in the Linux kernel's Tegra SOCTHERM thermal driver. When the driver is removed or its platform device is unbound, tegra_soctherm_remove() only removes the driver's debugfs entries and never calls thermal_cooling_device_unregister() for the cooling devices it registered. The thermal framework's cooling device list therefore retains thermal_cooling_device objects whose devdata pointer references memory already freed by the platform device's devm cleanup, and a later thermal framework operation dereferencing that stale memory can crash the kernel, causing a local denial of service. The CVE description also notes the theoretical possibility of arbitrary code execution, although no practical code-execution path is established by the available evidence. Exploitation requires local access and the ability to trigger driver or device removal, so the flaw is not network reachable.

Within Red Hat's portfolio, Red Hat Enterprise Linux 9 and 10 (including the kernel-rt variant), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL 9 CoreOS are affected. The fix for these products is currently deferred, and the residual risk is limited to a local denial of service on systems using the affected Tegra SOCTHERM thermal driver. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (built on RHEL CoreOS 8), are not affected because the vulnerable code is not present. Red Hat rates this flaw Moderate severity with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local, availability-only impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.