CVE-2026-89572: cpufreq: apple-soc: Fix OPP table cleanup
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: apple-soc: Fix OPP table cleanup
applesoccpufreqinit() adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic(), which is not the right cleanup helper for OPP tables loaded from firmware.
Use the cpumask OPP helper after the policy CPU mask has been populated. Pair it with the matching cpumask remove helper on failure paths and in applesoccpufreqexit(). This also removes the separate devpmoppsetsharingcpus() call, as the cpumask helper loads the DT OPP tables for all CPUs in the policy.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected code is the Linux kernel cpufreq apple-soc driver. The issue concerns systems where that driver loads CPU operating-performance-point tables from firmware.
When can the vulnerable cleanup path be reached?
It can be reached when apple_soc_cpufreq_init() adds firmware OPP tables and subsequently encounters a failure path, or when the driver exits. In those cases, the prior cleanup did not use the matching cpumask-based OPP removal helper.
How can I determine whether a deployed kernel includes the fix?
Check whether the kernel source or applied stable patches include any of the referenced commits: 7c19b94c625dc7042b0a7dff4c8da158358ffa2c, 36c55d118d5ecd2fb444f52802955903937b9ccd, or d87cb889dc7ab1f2deecadf2a5e9023184bd7900. The corrected driver uses the cpumask OPP helper to load firmware tables and the matching cpumask removal helper for failures and driver exit.