CVE-2026-64373

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in Linux Kernel cpufreq Suspend

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64373

EUVD

EUVD-2026-48917

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Linux kernel's CPU frequency scaling (cpufreq) subsystem during system reboot. When the system reboots, cpufreq_suspend() is called but unlike normal suspend, it doesn't freeze userspace processes. This allows CPU hotplug operations to run concurrently, potentially freeing governor_data while cpufreq_suspend() is still accessing it, leading to a kernel null pointer dereference crash.

Detection Guidance

This vulnerability is specific to the Linux kernel and may not have direct network detection methods. Check kernel logs for null pointer dereference errors during system reboots, particularly around CPU frequency scaling. Commands like dmesg | grep -i 'null pointer' or journalctl -k | grep -i 'cpufreq' may help identify related crashes.

Impact Analysis

This vulnerability could cause system crashes during reboot, potentially leading to data corruption or denial of service. Systems relying on CPU frequency scaling may become unstable or fail to reboot properly, affecting availability and performance.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel race condition during system reboot. It may indirectly impact availability of systems handling sensitive data if exploited, but no evidence suggests direct regulatory implications.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this issue. If immediate patching is not possible, avoid frequent reboots and monitor system stability. Disable CPU hotplug operations if feasible until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70