Linux Kernel Thermal Subsystem Double-Free Vulnerability in Thermal Zone Unregistration

A double-free vulnerability has been identified in the Linux kernel's thermal subsystem, specifically within the thermal zone unregistration process. This issue arises because the function 'thermal_zone_device_register()' allocates a copy of the thermal zone parameters and frees it upon unregistration. Consequently, the 'thermal_of_zone_register()' function inadvertently leaks the original parameters while double-freeing the copied version. The vulnerability affects Linux kernel versions 6.4 and later.

Impact

Exploitation of this vulnerability could lead to memory corruption issues, such as a double-free condition, which can be exploited to execute arbitrary code or cause a denial-of-service by crashing the system.

Remediation

Users can upgrade to the latest version of the Linux kernel to address this vulnerability. The patched version is included in the official Linux kernel repositories.