CVE-2026-43401

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()

The update_cpu_qos_request() function attempts to initialize the 'freq'

variable by dereferencing 'cpudata' before verifying if the 'policy'

is valid.

This issue occurs on systems booted with the "nosmt" parameter, where

all_cpu_data[cpu] is NULL for the SMT sibling threads. As a result,

any call to update_qos_requests() will result in a NULL pointer

dereference as the code will attempt to access pstate.turbo_freq using

the NULL cpudata pointer.

Also, pstate.turbo_freq may be updated by intel_pstate_get_hwp_cap()

after initializing the 'freq' variable, so it is better to defer the

'freq' until intel_pstate_get_hwp_cap() has been called.

Fix this by deferring the 'freq' assignment until after the policy and

driver_data have been validated.

[ rjw: Added one paragraph to the changelog ]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References