In the Linux kernel, the following vulnerability has been resolved:
thermal: core: Fix thermal zone device registration error path
If thermalzonedeviceregisterwithtrips() fails after registering a thermal zone device, it needs to wait for the tz->removal completion like thermalzonedeviceunregister(), in case user space has managed to take a reference to the thermal zone device's kobject, in which case thermal_release() may not be called by the error path itself and tz may be freed prematurely.
Add the missing waitforcompletion() call to the thermal zone device registration error path.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43332.json",
"cna_assigner": "Linux"
}