GHSA-HM78-CGJX-C8PF
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
thermal/drivers/rcar: Fix error checking in probe()
This code accidentally calls thermal_zone_device_enable() before checking whether thermal_zone_device_register_with_trips() failed. Move the call until later to avoid an error pointer dereference of "priv->zone".
The driver works differently depending on if we are using OF thermal or not. We use thermal_add_hwmon_sysfs() if we are using OF thermal and call thermal_zone_device_enable() if not. We can share same error check for if either of these fail.
Moving the thermal_zone_device_enable() call is a bit cleaner as well. The original code used a three step process to cleanup: 1. Call thermal_zone_device_unregister() to cleanup. 2. Set priv->zone to an error pointer to preserve the error code. 3. Set priv->zone to NULL to avoid a second call to thermal_zone_device_unregister() in the rcar_thermal_remove() function.
Now we can just do a direct goto error_unregister and rcar_thermal_remove() handles the cleanup properly.
{
"affected": [],
"aliases": [
"CVE-2026-93142"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:18:09Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/rcar: Fix error checking in probe()\n\nThis code accidentally calls thermal_zone_device_enable() before checking\nwhether thermal_zone_device_register_with_trips() failed. Move the call\nuntil later to avoid an error pointer dereference of \"priv-\u003ezone\".\n\nThe driver works differently depending on if we are using OF thermal or\nnot. We use thermal_add_hwmon_sysfs() if we are using OF thermal and\ncall thermal_zone_device_enable() if not. We can share same error check\nfor if either of these fail.\n\nMoving the thermal_zone_device_enable() call is a bit cleaner as well.\nThe original code used a three step process to cleanup:\n1. Call thermal_zone_device_unregister() to cleanup.\n2. Set priv-\u003ezone to an error pointer to preserve the error code.\n3. Set priv-\u003ezone to NULL to avoid a second call to\n thermal_zone_device_unregister() in the rcar_thermal_remove()\n function.\n\nNow we can just do a direct goto error_unregister and rcar_thermal_remove()\nhandles the cleanup properly.",
"id": "GHSA-hm78-cgjx-c8pf",
"modified": "2026-09-17T18:32:12Z",
"published": "2026-09-17T18:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93142"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/35bf61798e7d4abf39667d98f298f793b3dd9bbe"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/623349a18d4c6e6add7876553c0cb6947c8d92e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/810875c5996f731961fc5ee1bd24e711f2e8fe78"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a85bcd0c7ef66e3404b3c99e5589c5ea622a757e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d67607e7749527850619a10d3ed033b02dcea516"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dd04ad1cdabcad51e34b74b4e91b9aeb7180d05d"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.