CVE-2026-97475: thermal/drivers/tegra/soctherma: Switch to devm cooling device registration

CVE-2026-97475: thermal/drivers/tegra/soctherma: Switch to devm cooling device registration

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/tegra/soctherma: Switch to devm cooling device registration

Use devm_thermal_of_cooling_device_register() to simplify resource
management and avoid manual cleanup in error paths.

As a side effect this change has the benefit of solving an existing
issue. Before, the function tegra_soctherm_remove() only called
debugfs_remove_recursive() and never called thermal_cooling_device_unregister()
for any of the cooling devices registered here.

After the driver removal, the thermal framework's cdev list would
still hold references to thermal_cooling_device objects whose devdata
pointer (ts) pointed to memory already freed by the platform device's
devm cleanup.

With this change, the cooling device is unregistered when the driver
is removed, thus fixing the issue above.

The Linux kernel CVE team has assigned CVE-2026-97475 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.12.111 with commit 6f2a863e7e9adf6088fe644259576181e60ee5e5
	Fixed in 6.18.53 with commit deaeb7be8e6b04c8b71080acba1bd88698f56b1d
	Fixed in 7.2 with commit ee126267bc04bfb03816ae9d71ca24c5bf99e739

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97475
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/thermal/tegra/soctherm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6f2a863e7e9adf6088fe644259576181e60ee5e5
	https://git.kernel.org/stable/c/deaeb7be8e6b04c8b71080acba1bd88698f56b1d
	https://git.kernel.org/stable/c/ee126267bc04bfb03816ae9d71ca24c5bf99e739