PT-2026-38983 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-16 · CVE-2026-43332

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the thermal core where the thermal zone device register with trips() function fails to properly handle the error path during thermal zone device registration. If the registration fails after the device is registered, the system does not wait for the tz->removal completion. This can lead to a situation where the tz object is freed prematurely if user space has already taken a reference to the thermal zone device's kobject, as thermal release() might not be called by the error path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43332

Affected Products

Linux Kernel

References · 16

• https://security-tracker.debian.org/tracker/CVE-2026-43332 · Vendor Advisory
• https://git.kernel.org/stable/c/9e796001af97a1f7368d5114b7a8533dd98d797a · Patch
• https://git.kernel.org/stable/c/4d390f0e507dfb16d58f83a58d78d1150dc8b9d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43332 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43332 · Security Note
• https://git.kernel.org/stable/c/9e07e3b81807edd356e1f794cffa00a428eff443 · Patch
• https://git.kernel.org/stable/c/c4c7219e93319bba9ba0765dee597784c78f63c5 · Patch
• https://ubuntu.com/security/CVE-2026-43332 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43332 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43332 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43332 · Vendor Advisory
• https://git.kernel.org/stable/c/604da9c04c218362e1c1457304ebeb9c199d537c · Patch
• https://twitter.com/infoflowcloud/status/2052812365368844351 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43332 · Note
• https://git.kernel.org/linus/9e07e3b81807edd356e1f794cffa00a428eff443 · Note