CVE-2026-64373

cpufreq: Fix hotplug-suspend race during reboot

Published Jul 25, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Fix hotplug-suspend race during reboot

During system reboot, cpufreq_suspend() is called via the
kernel_restart() -> device_shutdown() path. Unlike the normal system
suspend path, the reboot path does not call freeze_processes(), so
userspace processes and kernel threads remain active.

This allows CPU hotplug operations to run concurrently with
cpufreq_suspend(). The original code has no synchronization with CPU
hotplug, leading to a race condition where governor_data can be freed
by the hotplug path while cpufreq_suspend() is still accessing it,
resulting in a null pointer dereference:

Unable to handle kernel NULL pointer dereference
Call Trace:
do_kernel_fault+0x28/0x3c
cpufreq_suspend+0xdc/0x160
device_shutdown+0x18/0x200
kernel_restart+0x40/0x80
arm64_sys_reboot+0x1b0/0x200

Fix this by adding cpus_read_lock()/cpus_read_unlock() to
cpufreq_suspend() to block CPU hotplug operations while suspend is in
progress.

[ rjw: Changelog edits ]

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< 6d5dd354c37abaf4d60400c55c71f23ba2b33639
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< 9103078c7b3091a2fbb52af176f95982ee7dd7f8
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< cd4524ff6567fa4458a5bec4b017105e671d393e
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< 73255d702c7560185fd5951aadcf7eb057c2f453
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< a0ef2fc89d28ca62923376c4b8ffaa57136a36be
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< 6e175c00c62dca3d91b987015808b5d52e8db2b4
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< a0106b41f9a724868d390b8b3b4ea5ca0e04ea53
`65650b35133ff20f0c9ef0abd5c3c66dbce3ae57`	affected	< a9029dd55696c651ee46912afa2a166fa456bb3e
`8bfa06ea6e81bf08d2132d7e70c2b5313b34caf8`	affected	—
`7ccf3b8b7a12dc9da158c2e699c36d04b2496944`	affected	—
`5f466713989250938624afa79dc33bae20920700`	affected	—
`89ab39da1452d272007acc5912d4008047b86706`	affected	—
`cb4b4601f910c78d2b49f637a12ef98b41cb76a9`	affected	—
`4.4.198`	affected	< 4.5
`4.9.198`	affected	< 4.10
`4.14.151`	affected	< 4.15
`4.19.81`	affected	< 4.20
`5.3.8`	affected	< 5.4

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.4:-::::::
	cpe:2.3:o:linux:linux_kernel:5.4:rc4::::::
	cpe:2.3:o:linux:linux_kernel:5.4:rc5::::::
	cpe:2.3:o:linux:linux_kernel:5.4:rc6::::::
	cpe:2.3:o:linux:linux_kernel:5.4:rc7::::::
	cpe:2.3:o:linux:linux_kernel:5.4:rc8::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,6d5dd354c37abaf4d60400c55c71f23ba2b33639)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,9103078c7b3091a2fbb52af176f95982ee7dd7f8)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,cd4524ff6567fa4458a5bec4b017105e671d393e)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,73255d702c7560185fd5951aadcf7eb057c2f453)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,a0ef2fc89d28ca62923376c4b8ffaa57136a36be)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,6e175c00c62dca3d91b987015808b5d52e8db2b4)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,a0106b41f9a724868d390b8b3b4ea5ca0e04ea53)`	affected	code_commit	—
`[65650b35133ff20f0c9ef0abd5c3c66dbce3ae57,a9029dd55696c651ee46912afa2a166fa456bb3e)`	affected	code_commit	—
`8bfa06ea6e81bf08d2132d7e70c2b5313b34caf8`	affected	code_commit	—
`7ccf3b8b7a12dc9da158c2e699c36d04b2496944`	affected	code_commit	—
`5f466713989250938624afa79dc33bae20920700`	affected	code_commit	—
`89ab39da1452d272007acc5912d4008047b86706`	affected	code_commit	—
`cb4b4601f910c78d2b49f637a12ef98b41cb76a9`	affected	code_commit	—
`[4.4.198,4.5)`	affected	semver	—
`[4.9.198,4.10)`	affected	semver	—
`[4.14.151,4.15)`	affected	semver	—
`[4.19.81,4.20)`	affected	semver	—
`[5.3.8,5.4)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.4`	affected	semver	—
`[0,5.4)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.089% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639
https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4
https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453
https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8
https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53
https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be
https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e
https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e
https://lore.kernel.org/linux-cve-announce/2026072523-CVE-2026-64373-2ee3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64373
https://www.cve.org/CVERecord?id=CVE-2026-64373

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 3:30 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362
CPEs		cpe:2.3:o:linux:linux_kernel:5.4:-:::::: cpe:2.3:o:linux:linux_kernel:5.4:rc4:::::: cpe:2.3:o:linux:linux_kernel:5.4:rc5:::::: cpe:2.3:o:linux:linux_kernel:5.4:rc6:::::: cpe:2.3:o:linux:linux_kernel:5.4:rc7:::::: cpe:2.3:o:linux:linux_kernel:5.4:rc8::::::
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Jul 30, 2026 4:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Jul 28, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072523-CVE-2026-64373-2ee3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64373 https://www.cve.org/CVERecord?id=CVE-2026-64373
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jul 26, 2026 2:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-476

Jul 25, 2026 9:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. [ rjw: Changelog edits ]
Title		cpufreq: Fix hotplug-suspend race during reboot
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639 https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4 https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453 https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8 https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53 https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e