UBUNTU-CVE-2026-89572: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup applesoccpufreqinit() adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses devpmoppremovealldynamic(), which is not the right cleanup helper for OPP tables loaded from firmware. Use the cpumask OPP helper after the policy CPU mask has been populated. Pair it with the matching cpumask remove helper on failure paths and in applesoccpufreqexit(). This also removes the separate devpmoppsetsharingcpus() call, as the cpumask helper loads the DT OPP tables for all CPUs in the policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the Apple SoC cpufreq driver cleanup logic: after the policy CPU mask is populated, use the cpumask OPP helper to load DT OPP tables for all policy CPUs; pair it with the matching cpumask remove helper on initialization failure paths and in apple_soc_cpufreq_exit(); replace dev_pm_opp_remove_all_dynamic() for firmware-loaded OPP tables, and remove the separate dev_pm_opp_set_sharing_cpus() call.
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are listed as affected or tracked?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
Are fixed package versions provided?
No fixed Ubuntu package versions are included in the provided data. Use the relevant Ubuntu security advisory or package metadata to determine whether an installed kernel contains the fix.
What conditions in the driver are relevant to this issue?
The issue concerns failure paths after the Apple SoC CPU frequency driver has loaded OPP tables from firmware. The corrected implementation removes OPP tables using the matching CPU-mask cleanup helper both on initialization failure and when the driver exits.
Does the provided information state attacker prerequisites or an exploitation method?
No. The provided data describes a driver resource-cleanup defect but does not specify an attacker access level, exploitation method, or impact beyond the medium severity classification.