CVE-2026-97905
Received Received - Intake

Linux Kernel cpufreq Policy cpumask Uninitialized Memory Exposure

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreq_policy_alloc() allocates policy->cpus with alloc_cpumask_var(), i.e. without __GFP_ZERO, unlike the sibling related_cpus and real_cpus masks. With CONFIG_CPUMASK_OFFSTACK=y the mask is a separate kmalloc_node() allocation, so its bitmap holds whatever the slab allocator left behind: cpufreq_online() cpufreq_policy_alloc() alloc_cpumask_var(&policy->cpus) /* bitmap is uninitialized */ kobject_init_and_add() /* policy%u/ appears in sysfs */ cpufreq_policy_online() cpumask_copy(policy->cpus, cpumask_of(cpu)) /* first valid value */ This leaves a window in which the sysfs attributes are already reachable while policy->cpus is still garbage. show()/store() gate on policy_is_inactive(), i.e. cpumask_empty(policy->cpus), so a non-zero bitmap makes them run the attribute callbacks on a policy that is not initialized yet. Fix this by using zalloc_cpumask_var() for policy->cpus.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97905
EUVD
EUVD-2026-86759

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an uninitialized cpumask in the cpufreq subsystem. When a CPU frequency policy is allocated, the policy->cpus mask is not zeroed out before being published in sysfs. This creates a window where sysfs attributes are accessible while the policy data is still in an invalid state. Attackers could potentially read or write to these attributes before the policy is properly initialized.

Detection Guidance

This vulnerability is specific to the Linux kernel's cpufreq subsystem and requires kernel source code inspection or runtime analysis. No standard network or system commands can directly detect this issue. Kernel developers or security teams should review the cpufreq policy allocation code for uninitialized cpumask usage.

Impact Analysis

This vulnerability could allow local attackers to read or modify CPU frequency policy attributes before they are properly initialized. This might lead to unexpected system behavior, crashes, or privilege escalation if exploited. Systems using CONFIG_CPUMASK_OFFSTACK=y are particularly affected as the uninitialized mask is stored in a separate memory allocation.

Mitigation Strategies

Apply the kernel patch that replaces alloc_cpumask_var() with zalloc_cpumask_var() for policy->cpus initialization. Update to a kernel version containing this fix. If patching is not possible, disable CONFIG_CPUMASK_OFFSTACK to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart