CVE-2026-64373
Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]
How to fix
- linux linux_kernel4.5, 4.10, 4.15, 4.20, 5.4, 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4 or later
- git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639
- git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4
- git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453
- git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8
- git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53
- git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be
- git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e
- git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.4.198 ≤ v < 4.5, 4.9.198 ≤ v < 4.10, 4.14.151 ≤ v < 4.15, 4.19.81 ≤ v < 4.20, 5.3.8 ≤ v < 5.4, 5.4.1 ≤ v < 5.10.261, 5.11 ≤ v < 5.15.212, 5.16 ≤ v < 6.1.178, 6.2 ≤ v < 6.6.145, 6.7 ≤ v < 6.12.96, 6.13 ≤ v < 6.18.39, 6.19 ≤ v < 7.1.4, 5.4 | 4.5, 4.10, 4.15, 4.20, 5.4, 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.