The Linux kernel thermal core contains a race condition that leads to a use‑after‑free when a thermal zone is unregistered during a resume operation. If thermal_pm_notify_complete() is called while a delayed work item is running, the cancel_delayed_work_sync() call may miss that work, allowing the thermal zone object to be freed while the work continues. The resulting kernel memory corruption can potentially lead to local privilege escalation. This weakness is a classic use‑after‑free (CWE‑416) and involves a race condition (CWE‑825).

Any Linux system running a kernel that has not applied the patch to move the cancel_delayed_work() call into thermal_zone_pm_prepare() and to use a dedicated workqueue for thermal events is affected. This includes all kernel versions prior to the fix, including early release candidates of kernel 7.0.

With a CVSS score of 7.8 the vulnerability is considered high severity. The EPSS score is below 1%, indicating a low but nonzero probability of exploitation. The CVE is not listed in CISA’s KEV catalog, indicating that widespread exploitation is not currently observed. Attackers would need local kernel access to trigger the race, for example by interacting with removable devices that cause thermal zone unregister operations. Once the race is exploited, a local attacker could gain kernel‑level privileges by corrupting kernel memory. The narrow exploitation window lowers the practical risk until the patch is applied.