CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot
cpufreq: Fix hotplug-suspend race during reboot
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
In the kernel code path for cpufreq_suspend(), add cpus_read_lock()/cpus_read_unlock() so CPU hotplug operations cannot run concurrently with cpufreq_suspend() during reboot/suspend handling.
Linux kernel cpufreq CPU hotplug synchronization in cpufreq_suspend() = Add cpus_read_lock()/cpus_read_unlock() around the critical section of cpufreq_suspend() to block CPU hotplug while suspend is accessing governor_data
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64373?
CVE-2026-64373 has a medium severity rating of 4.7.
What is the risk associated with CVE-2026-64373?
The risk score for CVE-2026-64373 is 28.
How does CVE-2026-64373 affect the Linux kernel?
CVE-2026-64373 involves a race condition during reboot that affects cpufreq, potentially leading to system instability.
How do I fix CVE-2026-64373?
To fix CVE-2026-64373, update your Linux kernel to a version that includes the patch for this vulnerability.
What types of vulnerabilities does CVE-2026-64373 address?
CVE-2026-64373 addresses issues related to null pointer dereference and a race condition.