In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Fix hotplug-suspend race during reboot

During system reboot, cpufreq_suspend() is called via the
kernel_restart() -> device_shutdown() path. Unlike the normal system
suspend path, the reboot path does not call freeze_processes(), so
userspace processes and kernel threads remain active.

This allows CPU hotplug operations to run concurrently with
cpufreq_suspend(). The original code has no synchronization with CPU
hotplug, leading to a race condition where governor_data can be freed
by the hotplug path while cpufreq_suspend() is still accessing it,
resulting in a null pointer dereference:

Unable to handle kernel NULL pointer dereference
Call Trace:
do_kernel_fault+0x28/0x3c
cpufreq_suspend+0xdc/0x160
device_shutdown+0x18/0x200
kernel_restart+0x40/0x80
arm64_sys_reboot+0x1b0/0x200

Fix this by adding cpus_read_lock()/cpus_read_unlock() to
cpufreq_suspend() to block CPU hotplug operations while suspend is in
progress.

[ rjw: Changelog edits ]

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < 6d5dd354c37abaf4d60400c55c71f23ba2b33639
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < 9103078c7b3091a2fbb52af176f95982ee7dd7f8
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < cd4524ff6567fa4458a5bec4b017105e671d393e
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < 73255d702c7560185fd5951aadcf7eb057c2f453
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < a0ef2fc89d28ca62923376c4b8ffaa57136a36be
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < 6e175c00c62dca3d91b987015808b5d52e8db2b4
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < a0106b41f9a724868d390b8b3b4ea5ca0e04ea53
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 affected < a9029dd55696c651ee46912afa2a166fa456bb3e
8bfa06ea6e81bf08d2132d7e70c2b5313b34caf8 affected —
7ccf3b8b7a12dc9da158c2e699c36d04b2496944 affected —
5f466713989250938624afa79dc33bae20920700 affected —
89ab39da1452d272007acc5912d4008047b86706 affected —
cb4b4601f910c78d2b49f637a12ef98b41cb76a9 affected —
4.4.198 affected < 4.5
4.9.198 affected < 4.10
4.14.151 affected < 4.15
4.19.81 affected < 4.20
5.3.8 affected < 5.4
Linux Linux affected
Version Status Constraints
5.4 affected —
0 unaffected < 5.4
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.96 unaffected ≤ 6.12.*
6.18.39 unaffected ≤ 6.18.*
7.1.4 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639 cve-icon
https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4 cve-icon
https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453 cve-icon
https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8 cve-icon
https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53 cve-icon
https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be cve-icon
https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e cve-icon
https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e cve-icon
History

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]
Title cpufreq: Fix hotplug-suspend race during reboot
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T08:50:25.427Z

Reserved: 2026-07-19T15:36:31.784Z

Link: CVE-2026-64373

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.