PT-2026-64594 · Linux · Linux

CVE-2026-64373 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Fix hotplug-suspend race during reboot

During system reboot, cpufreq suspend() is called via the kernel restart() -> device shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze processes(), so userspace processes and kernel threads remain active.

This allows CPU hotplug operations to run concurrently with cpufreq suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor data can be freed by the hotplug path while cpufreq suspend() is still accessing it, resulting in a null pointer dereference:

Unable to handle kernel NULL pointer dereference Call Trace: do kernel fault+0x28/0x3c cpufreq suspend+0xdc/0x160 device shutdown+0x18/0x200 kernel restart+0x40/0x80 arm64 sys reboot+0x1b0/0x200

Fix this by adding cpus read lock()/cpus read unlock() to cpufreq suspend() to block CPU hotplug operations while suspend is in progress.

[ rjw: Changelog edits ]

Related Identifiers

CVE-2026-64373

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64373 · Security Note
• https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be · Note
• https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53 · Note
• https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8 · Note
• https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453 · Note
• https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e · Note
• https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e · Note
• https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4 · Note
• https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639 · Note