CVE-2025-40194

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

The cpufreq_cpu_put() call in update_qos_request() takes place too early

because the latter subsequently calls freq_qos_update_request() that

indirectly accesses the policy object in question through the QoS request

object passed to it.

Fortunately, update_qos_request() is called under intel_pstate_driver_lock,

so this issue does not matter for changing the intel_pstate operation

mode, but it theoretically can cause a crash to occur on CPU device hot

removal (which currently can only happen in virt, but it is formally

supported nevertheless).

Address this issue by modifying update_qos_request() to drop the

reference to the policy later.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References