CVE-2026-89572

Received Received - Intake

Memory Leak in Linux Kernel cpufreq Apple SoC Driver

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses dev_pm_opp_remove_all_dynamic(), which is not the right cleanup helper for OPP tables loaded from firmware. Use the cpumask OPP helper after the policy CPU mask has been populated. Pair it with the matching cpumask remove helper on failure paths and in apple_soc_cpufreq_exit(). This also removes the separate dev_pm_opp_set_sharing_cpus() call, as the cpumask helper loads the DT OPP tables for all CPUs in the policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89572

EUVD

EUVD-2026-76484

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper cleanup of OPP (Operating Performance Points) tables in the apple-soc cpufreq driver. When initializing, the driver adds OPP tables from firmware but fails to remove them in some error scenarios. It incorrectly uses dev_pm_opp_remove_all_dynamic() for cleanup instead of the proper cpumask helper.

Detection Guidance

This vulnerability is specific to the Linux kernel's cpufreq driver for Apple SoCs. Detection requires checking kernel logs for OPP table cleanup failures or examining the apple-soc cpufreq driver behavior. No standard network commands apply. Check kernel logs with 'dmesg | grep apple-soc' or inspect driver initialization with 'lsmod | grep apple_soc_cpufreq'.

Impact Analysis

This issue could lead to resource leaks where OPP tables remain allocated even after the driver exits or fails. It may cause system instability or unexpected behavior in CPU frequency scaling on Apple SoC-based systems.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it relates to CPU frequency management in the Linux kernel and does not involve data handling or privacy issues.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-89572. Monitor kernel updates from your distribution vendor and apply them promptly. No manual mitigation steps are required beyond updating the kernel.

Hi! I’m here to help you understand CVE-2026-89572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70