CVE-2026-92504

What it actually does

Failure to release per-ODVP sysfs files and cached pointers on probe error paths after evaluate_odvp() succeeds leaves dangling kernel structures that can later be dereferenced, enabling use-after-free.

Why it matters to the business

Local attackers on affected Linux systems may crash the kernel or escalate privileges, risking system instability and data exposure on servers and endpoints using Intel thermal zones.

How an attack unfolds

An attacker with local access triggers repeated module load or probe failures (for example via crafted thermal configuration or concurrent sysfs access) so that evaluate_odvp() allocates ODVP objects that are never cleaned up; subsequent operations on the stale pointers cause the use-after-free.

How to fix it

Update to a kernel containing the corrected unwind logic that moves ODVP cleanup into the common ART/TRT failure path and clears cached pointers inside cleanup_odvp().

How to confirm the fix worked

Confirm the patch is present by inspecting the int3400_thermal probe error paths for the relocated cleanup_odvp() call and the pointer-clearing statements; recompile and boot-test probe failure scenarios.

Typical attack path

1. Obtain local user access on a vulnerable kernel
2. Cause or race the int3400_thermal probe to reach evaluate_odvp()
3. Force a failure in thermal_tripless_zone_device_register() or later steps
4. Trigger reuse of the uncleared ODVP pointers to achieve use-after-free

How to detect it

Review kernel logs for int3400 probe failure messages followed by later thermal or sysfs warnings; inspect for repeated module load/unload patterns that could indicate exploitation attempts.

What your security team should do

• Prioritize kernel upgrades on all Intel platforms that load int3400_thermal
• Monitor for local privilege-escalation attempts while patches are applied
• Restrict unprivileged module loading and thermal sysfs write access until fixed