Linux Kernel CVE-2026-43332

Primary remediation is upgrading to patched kernel versions: 6.6.134+ for 6.6.x series, 6.12.81+ for 6.12.x series, 6.18.22+ for 6.18.x series, 6.19.12+ for 6.19.x series, or 7.0+ for mainline. Upstream patches available at https://git.kernel.org/stable/c/604da9c04c218362e1c1457304ebeb9c199d537c and related commits. Organizations unable to immediately patch can implement compensating controls by restricting local access via mandatory access control policies (SELinux targeted policy enforcement, AppArmor confinement) to limit which users/processes can trigger thermal zone registration operations, though this has operational overhead and may impact legitimate thermal management tools. Alternatively, in container/virtualization environments, use separate kernel namespaces or dedicated VM instances for untrusted workloads to prevent local exploitation from reaching host kernel. Note that disabling CONFIG_THERMAL is not viable on production systems as it breaks temperature monitoring and thermal throttling critical for hardware protection. Prioritize patching on multi-tenant systems, shared hosting infrastructure, and container platforms where untrusted users have local shell access. Single-user desktop/laptop systems present minimal risk under normal usage.