CVE-2026-31731

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thermal: core: Address thermal zone removal races with resume

Since thermal_zone_pm_complete() and thermal_zone_device_resume()

re-initialize the poll_queue delayed work for the given thermal zone,

the cancel_delayed_work_sync() in thermal_zone_device_unregister()

may miss some already running work items and the thermal zone may

be freed prematurely [1].

There are two failing scenarios that both start with

running thermal_pm_notify_complete() right before invoking

thermal_zone_device_unregister() for one of the thermal zones.

In the first scenario, there is a work item already running for

the given thermal zone when thermal_pm_notify_complete() calls

thermal_zone_pm_complete() for that thermal zone and it continues to

run when thermal_zone_device_unregister() starts. Since the poll_queue

delayed work has been re-initialized by thermal_pm_notify_complete(), the

running work item will be missed by the cancel_delayed

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References