CVE-2026-74604

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is in thermal_add_hwmon_sysfs() during thermal zone/hwmon driver registration; it is only reachable from kernel thermal driver probe/init paths, not from network protocols or physical buses.

AC:LAttack complexity, low

When a second thermal zone shares an existing hwmon type and registration fails, the error path deterministically kfree()s a still-linked hwmon object, leaving a dangling entry that any later sysfs access can hit without winning a race.

PR:NPrivileges required, none

No privileges are needed to exploit the resulting UAF: hwmon temp attributes are world-readable (0444) and unprivileged local processes routinely read /sys/class/hwmon on phones, servers, and embedded devices after latent corruption during multi-sensor thermal probe.

UI:NUser interaction, none

Exploitation requires no victim interaction beyond normal system operation; reading thermal sensors or subsequent kernel hwmon operations can trigger use of the freed object automatically.

S:UScope, unchanged

Impact is confined to kernel memory corruption and privilege escalation within the host kernel; it does not cross VM, container, or IOMMU security boundaries by itself.

C:HConfidentiality impact, high

The use-after-free of struct thermal_hwmon_device leaves a dangling list entry and device pointer; subsequent sysfs reads or thermal hwmon operations can dereference attacker-influencable freed heap memory, enabling arbitrary kernel memory disclosure.

I:HIntegrity impact, high

Heap UAF on a long-lived thermal_hwmon_device structure adjacent to list pointers and device objects provides standard kernel heap corruption primitives that can be developed into arbitrary write and local privilege escalation.

A:HAvailability impact, high

Use-after-free in kernel thermal/hwmon registration can cause immediate kernel oops/panic on access to the freed hwmon device, and repeated or concurrent sysfs access can reliably crash or hang the system.