CVE-2026-46021

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1

Description Issues exist in the thermal core regarding thermal zone governor cleanup. If thermal zone device register with trips() fails after a thermal governor is added to the zone being registered, the governor is not removed, resulting in a memory leak. Additionally, thermal zone device unregister() invokes thermal set governor() without first acquiring the thermal zone lock. This can create a race condition with governor updates via sysfs, potentially leading to a use-after-free scenario, where the system attempts to access memory that has already been freed.

Recommendations For Linux kernel, add thermal set governor() calls to thermal release() to remove the governor from the thermal zone and to the thermal zone registration error path to handle failures preceding device registration. For openSUSE Tumbleweed, update to version kernel-devel-7.0.11-1.1.