CVE-2026-97904: cpufreq: initialize policy rwsem before sysfs publication
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: initialize policy rwsem before sysfs publication
cpufreqpolicyalloc() initializes policy->rwsem after kobjectinitandadd() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized.
Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.
Affected Software
Event History
Frequently Asked Questions
Under what condition can the race be triggered?
The race requires a sysfs access to a newly published CPU frequency policy while cpufreq_policy_alloc() has created the policy kobject and default sysfs attributes but has not yet initialized policy->rwsem.
What component is exposed to the uninitialized semaphore?
CPU frequency policy sysfs callbacks are exposed. They can be reached through the policy sysfs directory after it is published, before the policy read-write semaphore is initialized.
What change resolves the issue?
The fix initializes policy->rwsem before publishing the policy kobject with kobject_init_and_add(), ensuring sysfs callbacks always encounter an initialized semaphore.