CVE-2026-90364: ACPI: processor: Unregister cpufreq notifier on init failure
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: Unregister cpufreq notifier on init failure
acpiprocessordriverinit() registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state.
If driverregister() or cpuhpsetupstate() fails, the error path only unregisters the ACPI processor driver and the idle driver. The cpufreq notifier remains registered even though initialization failed.
Mirror the module exit path on the init failure path and unregister the cpufreq notifier when it has been registered.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this issue occur?
It can occur only when ACPI processor driver initialization fails after the cpufreq policy notifier has been registered, specifically if ACPI processor driver registration or CPU hotplug state setup fails.
What is left behind when initialization fails?
The cpufreq policy notifier remains registered despite the failed initialization. The corrected error path unregisters that notifier, matching the module exit cleanup behavior.
How can I determine whether a system is exposed?
Review the Linux kernel source or applied stable patches to determine whether the ACPI processor initialization failure path unregisters the cpufreq notifier. The provided references identify the fixes.