{"id":"CVE-2026-93142","state":"PUBLISHED","title":"thermal/drivers/rcar: Fix error checking in probe()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/rcar: Fix error checking in probe()\n\nThis code accidentally calls thermal_zone_device_enable() before checking\nwhether thermal_zone_device_register_with_trips() failed.  Move the call\nuntil later to avoid an error pointer dereference of \"priv->zone\".\n\nThe driver works differently depending on if we are using OF thermal or\nnot.  We use thermal_add_hwmon_sysfs() if we are using OF thermal and\ncall thermal_zone_device_enable() if not.  We can share same error check\nfor if either of these fail.\n\nMoving the thermal_zone_device_enable() call is a bit cleaner as well.\nThe original code used a three step process to cleanup:\n1. Call thermal_zone_device_unregister() to cleanup.\n2. Set priv->zone to an error pointer to preserve the error code.\n3. Set priv->zone to NULL to avoid a second call to\n   thermal_zone_device_unregister() in the rcar_thermal_remove()\n   function.\n\nNow we can just do a direct goto error_unregister and rcar_thermal_remove()\nhandles the cleanup properly.","publishedAt":"2026-09-17T16:11:41.430Z","updatedAt":"2026-10-19T09:06:14.866Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"a85bcd0c7ef66e3404b3c99e5589c5ea622a757e","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"810875c5996f731961fc5ee1bd24e711f2e8fe78","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"623349a18d4c6e6add7876553c0cb6947c8d92e6","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"35bf61798e7d4abf39667d98f298f793b3dd9bbe","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"d67607e7749527850619a10d3ed033b02dcea516","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"dd04ad1cdabcad51e34b74b4e91b9aeb7180d05d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thermal/renesas/rcar_thermal.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.9","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thermal/renesas/rcar_thermal.c"]}],"references":["https://git.kernel.org/stable/c/a85bcd0c7ef66e3404b3c99e5589c5ea622a757e","https://git.kernel.org/stable/c/810875c5996f731961fc5ee1bd24e711f2e8fe78","https://git.kernel.org/stable/c/623349a18d4c6e6add7876553c0cb6947c8d92e6","https://git.kernel.org/stable/c/35bf61798e7d4abf39667d98f298f793b3dd9bbe","https://git.kernel.org/stable/c/d67607e7749527850619a10d3ed033b02dcea516","https://git.kernel.org/stable/c/dd04ad1cdabcad51e34b74b4e91b9aeb7180d05d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/93xxx/CVE-2026-93142.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93142","state":"PUBLISHED","datePublished":"2026-09-17T16:11:41.430Z","dateUpdated":"2026-10-19T09:06:14.866Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-17T16:02:15.088Z"},"containers":{"cna":{"title":"thermal/drivers/rcar: Fix error checking in probe()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/rcar: Fix error checking in probe()\n\nThis code accidentally calls thermal_zone_device_enable() before checking\nwhether thermal_zone_device_register_with_trips() failed.  Move the call\nuntil later to avoid an error pointer dereference of \"priv->zone\".\n\nThe driver works differently depending on if we are using OF thermal or\nnot.  We use thermal_add_hwmon_sysfs() if we are using OF thermal and\ncall thermal_zone_device_enable() if not.  We can share same error check\nfor if either of these fail.\n\nMoving the thermal_zone_device_enable() call is a bit cleaner as well.\nThe original code used a three step process to cleanup:\n1. Call thermal_zone_device_unregister() to cleanup.\n2. Set priv->zone to an error pointer to preserve the error code.\n3. Set priv->zone to NULL to avoid a second call to\n   thermal_zone_device_unregister() in the rcar_thermal_remove()\n   function.\n\nNow we can just do a direct goto error_unregister and rcar_thermal_remove()\nhandles the cleanup properly."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"a85bcd0c7ef66e3404b3c99e5589c5ea622a757e","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"810875c5996f731961fc5ee1bd24e711f2e8fe78","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"623349a18d4c6e6add7876553c0cb6947c8d92e6","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"35bf61798e7d4abf39667d98f298f793b3dd9bbe","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"d67607e7749527850619a10d3ed033b02dcea516","versionType":"git"},{"version":"bbcf90c0646ac797700269fa6645a6a46466c79f","status":"affected","lessThan":"dd04ad1cdabcad51e34b74b4e91b9aeb7180d05d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thermal/renesas/rcar_thermal.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.9","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/thermal/renesas/rcar_thermal.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a85bcd0c7ef66e3404b3c99e5589c5ea622a757e"},{"url":"https://git.kernel.org/stable/c/810875c5996f731961fc5ee1bd24e711f2e8fe78"},{"url":"https://git.kernel.org/stable/c/623349a18d4c6e6add7876553c0cb6947c8d92e6"},{"url":"https://git.kernel.org/stable/c/35bf61798e7d4abf39667d98f298f793b3dd9bbe"},{"url":"https://git.kernel.org/stable/c/d67607e7749527850619a10d3ed033b02dcea516"},{"url":"https://git.kernel.org/stable/c/dd04ad1cdabcad51e34b74b4e91b9aeb7180d05d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T09:06:14.866Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}