The kernel creates one hwmon device for each thermal zone type and registers it under the first thermal zone. When the underlying thermal zone device is removed, the removal logic mistakenly skips deleting the hwmon device if another zone of the same type still has a sysfs attribute pointing to it. This causes the thermal zone removal to stall, leaving the kernel with dangling hwmon interfaces that never clean up. The result is a resource leak that can lead to number exhaustion of kernel objects and potentially a denial of system functionality.

All Linux kernel builds that implement the problematic hwmon registration logic, which existed in the mainline kernel prior to the patch referenced by this CVE. The issue is vendor‑agnostic because it affects the core kernel rather than a specific vendor’s distribution.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. An attacker would need local, privileged access to trigger the flaw—typically by unbinding an ACPI thermal driver, which is not an easily achievable goal for external adversaries. The lack of remote exploitation vectors and the patch‑level nature of the fix suggest that the current risk is moderate and confined to environments where kernel configuration or custom modules may interact directly with the thermal subsystem.