The Linux kernel’s thermal core failed to wait for the completion of a thermal zone device’s removal after a registration failure. As a result, if a thread still holds a reference to the device’s kobject, it may be freed prematurely by another part of the kernel, causing a use‑after‑free. This kernel fault can lead to a crash and bring the system down. Based on the description, it is inferred that the flaw can be triggered by code that forces a thermal zone registration to fail, which typically requires a privileged or local attacker capable of executing kernel‑level code.

All releases of the Linux kernel built before the applied fix are affected. The vulnerability applies to the entire Linux:Linux product family, and any vendor that ships an unpatched kernel image will be vulnerable. Because the specific version range is not enumerated, any kernel that does not contain the referenced commit is at risk. System administrators should verify that the running kernel contains the fix or upgrade to a newer release that incorporates it.

The EPSS score is not available and the fault is not listed in the CISA KEV catalog, suggesting that exploitation has not yet been observed in the wild. However, the use‑after‑free is a high‑severity kernel bug, and a local attacker could exploit it to crash the system. The likelihood of exploitation is therefore considered moderate until an exploit is documented, but the potential impact remains high.