HIGH Introduced in 5.8
int3400 ODVP Leak
CVE-2026-92504
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The current unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp() but before that label, including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind. Move the ODVP cleanup to the common ART/TRT unwind path so every failure after evaluate_odvp() releases the ODVP state. Also clear the cached ODVP pointers in cleanup_odvp(), because evaluate_odvp() can already call it for partial setup failures while probe continues.
02KernelScan AI Analysis
Risk summary
A resource leak in the Intel int3400 thermal driver's probe error path leaves sysfs files and allocated memory unreleased when certain registration steps fail after ODVP setup. The bug requires a local privileged actor and specific Intel hardware/firmware, limiting real-world risk to denial of service through repeated probing or memory exhaustion on affected platforms.
Vulnerability analysis
When the Intel int3400 thermal driver sets up a device, it creates sysfs files and allocates memory for platform-specific values before all required resources are registered. If a later registration step fails, the cleanup path does not release those earlier allocations, leaving them leaked. The fix ensures that every failure after this early setup properly releases the allocated state and clears cached references so stale pointers do not persist. The vulnerable code is reachable only on systems with the matching Intel thermal ACPI device, and triggering the leak requires a probe failure on that hardware, which an attacker cannot directly control from an unprivileged context.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.8 | 5.10.270 | 5798c714fccf |
| 5.15 | 5.8 | 5.15.221 | bfd6df12ce67 |
| 6.1 | 5.8 | 6.1.188 | ad13e550ce51 |
| 6.12 | 5.8 | 6.12.110 | bc0e96267a67 |
| 6.18 | 5.8 | 6.18.52 | d7b025d3fdf3 |
| 7.2 | 5.8 | 7.2.6 | 169772cd2147 |
| 6.6 | 5.8 | 6.6.157 | 08df725b9275 |
| mainline | 5.8 | 7.3-rc1 | d83dc9ce57a7 |
| cip/6.12 | 5.8 | 6.12.111-cip32 | bc0e96267a67 |