CVE-2026-45925

What it actually does

A reference count leak occurs when a device tree node handle obtained via of_parse_phandle is not released, causing a memory leak in the kernel's thermal management code.

Why it matters to the business

Over time, repeated use of affected thermal lookup functions can exhaust kernel memory, leading to system instability or crashes on Linux-based devices and servers.

How an attack unfolds

An attacker with local access triggers the thermal_of_cm_lookup function repeatedly without proper cleanup, gradually depleting available memory until the system becomes unresponsive.

How to fix it

Update the Linux kernel to a version containing the fix that applies the __free(device_node) cleanup attribute to release the node in thermal_of_cm_lookup.

How to confirm the fix worked

Review kernel source for the presence of __free(device_node) cleanup in thermal_of_cm_lookup or monitor kernel memory statistics after exercising thermal device tree lookups.

Typical attack path

1. Obtain local access to the system
2. Identify or craft inputs that invoke thermal_of_cm_lookup
3. Repeatedly trigger the function to accumulate unreleased references
4. Monitor until memory exhaustion occurs

How to detect it

Inspect kernel logs and memory statistics for signs of unreleased device tree nodes during thermal operations; no public exploitation artifacts are known.

What your security team should do

• Apply kernel updates from distribution vendors as soon as available
• Monitor kernel memory usage on systems exposing thermal subsystems
• Limit local access where feasible until patched