CVE-2026-43332 Git CVE debrief

Who should care

Linux kernel maintainers, distro security teams, embedded device vendors, and operators of systems that use the kernel thermal subsystem should care. Systems exposing thermal zone interfaces to user space are especially relevant because the bug depends on a user-space reference being present during a registration failure path.

Technical summary

The CVE description states that thermal_zone_device_register_with_trips() can fail after a thermal zone device has already been registered. In that case, the error path must wait for tz->removal completion just like thermal_zone_device_unregister() does. Without that synchronization, thermal_release() may not run before the object is freed, if user space has retained a reference to the thermal zone device's kobject. The reported fix is to add the missing wait_for_completion() call to the registration error path. NVD lists the issue with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

High

Recommended defensive actions

• Apply the upstream or vendor kernel patch that adds the missing wait_for_completion() in the thermal zone registration error path.
• Prioritize updates for kernels that include thermal core backports or vendor modifications to the thermal subsystem.
• Verify that your distribution's advisory or backport includes the exact lifecycle fix, not just adjacent thermal changes.
• If you maintain custom kernel trees, review thermal_zone_device_register_with_trips() error handling for the same completion wait used by thermal_zone_device_unregister().

Evidence notes

This debrief is based only on the supplied CVE description, NVD metadata, and the linked kernel.org stable references. The core fact pattern is: a failed thermal zone registration path can omit a completion wait, which may let tz be freed prematurely if user space still holds a kobject reference. NVD metadata provides the severity and CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The five supplied kernel.org stable links are the only patch references provided in the corpus.

Official resources