CVE-2026-92492: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
In the Linux kernel, the following vulnerability has been resolved:
cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
cpufreqcpuget() returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn down. Both amdpstatepowersupplynotifier() and amdpstateprofileset() acquire a policy via cpufreqcpuget() and then pass that pointer to amdpstategetbalancedepp() and amdpstatesetepp(), which dereference it unconditionally. A racing CPU hotplug or driver teardown can therefore lead to a NULL pointer dereference on either of these dynamic EPP paths.
The third cpufreqcpuget() caller in this file, amdpstateverify(), already handles the NULL case. Bring the two new callers in line with that pattern: return NOTIFYOK from the power-supply notifier (matching the other "nothing to do" exits) and -ENODEV from amdpstateprofileset() (the usual cpufreq error for a missing CPU policy).
Found by code inspection; not tested on hardware.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It requires a race in which a dynamic EPP callback obtains no cpufreq policy for its CPU, such as when that CPU is offline or its policy has already been torn down during CPU hotplug or driver teardown.
Which paths are affected?
The affected paths are the power-supply notifier, amd_pstate_power_supply_notifier(), and profile changes through amd_pstate_profile_set(). Both previously passed a potentially NULL policy to EPP helper functions that dereference it.
What is the impact of a successful trigger?
A successful race can cause a NULL pointer dereference in the Linux kernel. The provided information does not describe impacts beyond that crash condition.
How does the fix handle a missing policy?
The power-supply notifier returns NOTIFY_OK when no policy is available. amd_pstate_profile_set() returns -ENODEV, which is the usual cpufreq error for a missing CPU policy.