CVE-2026-92492: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

cpufreqcpuget() returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn down. Both amdpstatepowersupplynotifier() and amdpstateprofileset() acquire a policy via cpufreqcpuget() and then pass that pointer to amdpstategetbalancedepp() and amdpstatesetepp(), which dereference it unconditionally. A racing CPU hotplug or driver teardown can therefore lead to a NULL pointer dereference on either of these dynamic EPP paths.

The third cpufreqcpuget() caller in this file, amdpstateverify(), already handles the NULL case. Bring the two new callers in line with that pattern: return NOTIFYOK from the power-supply notifier (matching the other "nothing to do" exits) and -ENODEV from amdpstateprofileset() (the usual cpufreq error for a missing CPU policy).

Found by code inspection; not tested on hardware.

Affected Software

1 affected component
The Linux Kernel Project Linux Kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:10 PM
Data Sourced
via MITRE·04:10 PM
Description

Frequently Asked Questions

1

When can this issue be triggered?

It requires a race in which a dynamic EPP callback obtains no cpufreq policy for its CPU, such as when that CPU is offline or its policy has already been torn down during CPU hotplug or driver teardown.

2

Which paths are affected?

The affected paths are the power-supply notifier, amd_pstate_power_supply_notifier(), and profile changes through amd_pstate_profile_set(). Both previously passed a potentially NULL policy to EPP helper functions that dereference it.

3

What is the impact of a successful trigger?

A successful race can cause a NULL pointer dereference in the Linux kernel. The provided information does not describe impacts beyond that crash condition.

4

How does the fix handle a missing policy?

The power-supply notifier returns NOTIFY_OK when no policy is available. amd_pstate_profile_set() returns -ENODEV, which is the usual cpufreq error for a missing CPU policy.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203