CVE-2026-90178

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the coretemp driver within the hwmon subsystem on CPUs that do not support Package Thermal Sensor (PTS). The pdata->core data array is allocated in the init temp data() function but is only released via destroy temp data() when the CPU supports X86 FEATURE PTS. On unsupported CPUs, coretemp cpu online() does not trigger the package flag, leaving pdata->pkg data as NULL. Consequently, coretemp cpu offline() skips the package interface removal, and destroy temp data() is never called, causing the array to remain allocated when coretemp device remove() frees the platform data.

Recommendations Update the Linux kernel to a version where the coretemp device remove() function has been modified to release the pdata->core data array.