CVE-2026-43332 concerns a flaw in the Linux kernel's thermal core where the function thermal_zone_device_register_with_trips() lacked a wait_for_completion() call on its error path after a thermal zone device was registered. Without this synchronization, if user space held a reference to the thermal zone device's kobject, the thermal_release() function might not be called, leading to premature freeing of the thermal zone device structure. This could cause use-after-free conditions or system instability. The vulnerability was fixed by adding the missing wait_for_completion() call to the error path. This fix is included in a broad Linux kernel update that addresses numerous security issues across various architectures and subsystems.

The vulnerability could lead to premature freeing of kernel objects related to thermal zone devices, potentially causing system crashes or instability. The CVSS score is 7.8, indicating a high severity with impacts on confidentiality, integrity, and availability. However, the attack vector is local with low complexity and requires low privileges. There are no known exploits in the wild. The issue is one among many fixed in a comprehensive Linux kernel security update.

A patch is available and included in recent Linux kernel updates. Users should apply the official kernel updates from their distribution and reboot the system to activate the fixes. Due to an ABI change in the kernel, third-party kernel modules must be recompiled and reinstalled after updating. No additional mitigation steps are required beyond applying the official update.