CVE-2026-43332

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-43332

Key Details

CVE	CVE-2026-43332
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

thermal: core: Fix thermal zone device registration error path

If thermal_zone_device_register_with_trips() fails after registering

a thermal zone device, it needs to wait for the tz->removal completion

like thermal_zone_device_unregister(), in case user space has managed

to take a reference to the thermal zone device's kobject, in which case

thermal_release() may not be called by the error path itself and tz may

be freed prematurely.

Add the missing wait_for_completion() call to the thermal zone device

registration error path. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-43332
CVE	https://www.cve.org/CVERecord?id=CVE-2026-43332

Source

Reference

NVD

CVE