CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot
cpufreq: Fix hotplug-suspend race during reboot
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
Modify the Linux kernel cpufreq code so that cpufreq_suspend() takes cpus_read_lock() before accessing shared governor_data and releases it with cpus_read_unlock() when finished, preventing CPU hotplug operations from running concurrently and avoiding the hotplug-suspend race during reboot.
Linux kernel cpufreq Synchronization around cpufreq_suspend() = Add cpus_read_lock()/cpus_read_unlock() to block CPU hotplug operations while suspend/reboot executes cpufreq_suspend()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64373?
CVE-2026-64373 has a medium severity rating of 4.7.
What is the risk associated with CVE-2026-64373?
The risk score for CVE-2026-64373 is 28.
How does CVE-2026-64373 affect the Linux kernel?
CVE-2026-64373 involves a race condition during reboot that affects cpufreq, potentially leading to system instability.
How do I fix CVE-2026-64373?
To fix CVE-2026-64373, update your Linux kernel to a version that includes the patch for this vulnerability.
What types of vulnerabilities does CVE-2026-64373 address?
CVE-2026-64373 addresses issues related to null pointer dereference and a race condition.