The Linux kernel thermal core contains a race condition that allows a use‑after‑free when a thermal zone is unregistered during a resume operation. If an attacker can trigger thermal_pm_notify_complete() while a delayed work item is running, the cancel_delayed_work_sync() call may miss the work, and the thermal zone object can be freed while the work continues to execute. Running code that accesses freed memory can corrupt kernel state, potentially allowing local privilege escalation or remote code execution. The vulnerability is caused by a synchronization flaw that leads to a classic use‑after‑free (CWE‑416). The CVSS score of 7.0 indicates high severity, and the flaw also involves a race condition that satisfies CWE‑825.

Any Linux system running a kernel that implements the thermal core module without the patch is affected. The patch moves the cancel_delayed_work() call to thermal_zone_pm_prepare() and adds a dedicated workqueue, but affected distributions are not specified in the advisory. System administrators should verify whether their kernel version includes static or dynamic thermal zone drivers.

With a CVSS score of 7.0 the vulnerability is considered high severity. The EPSS score is not available and the CVE is not listed in CISA’s KEV catalog, indicating that widespread exploitation is not currently observed. Attackers would need local kernel access to trigger the race, for example by interacting with removable devices that cause thermal zone unregister operations. Once the race is exploited, a local attacker could achieve kernel‑level code execution. The narrow exploitation window lowers the practical risk until the patch is applied.