CVE-2026-64373

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Fix hotplug-suspend race during reboot

During system reboot, cpufreq_suspend() is called via the

kernel_restart() -> device_shutdown() path. Unlike the normal system

suspend path, the reboot path does not call freeze_processes(), so

userspace processes and kernel threads remain active.

This allows CPU hotplug operations to run concurrently with

cpufreq_suspend(). The original code has no synchronization with CPU

hotplug, leading to a race condition where governor_data can be freed

by the hotplug path while cpufreq_suspend() is still accessing it,

resulting in a null pointer dereference:

Unable to handle kernel NULL pointer dereference

Call Trace:

do_kernel_fault+0x28/0x3c

cpufreq_suspend+0xdc/0x160

device_shutdown+0x18/0x200

kernel_restart+0x40/0x80

arm64_sys_reboot+0x1b0/0x200

Fix this by adding cpus_read_lock()/cpus_read_unlock() to

cpufreq_suspend() to block CPU hotplug operations wh

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References