Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreqsuspend is called via the kernelrestart - deviceshutdown path. Unlike the normal system suspend path, the reboot path does not call freezeprocesses, so...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus using alloccpumaskvar, i.e., without GFPZERO, unlike the relatedcpus and realcpus masks. When CONFIGCPUMASKOFFSTACK=y is...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in OSC evaluation pcccpufreqdoosc calls acpievaluateobject twice for the two-phase OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated using devmkcalloccpudev, ..., where cpudev is the CPU device returned by getcpudevice0. This device is never unbound, so its devres list is nev...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...

CVE-2026-92492

A flaw was found in the Linux kernel's cpufreq/amd-pstate component. A local attacker could potentially trigger a NULL pointer dereference by performing a racing CPU hotplug or driver teardown operation. This occurs because certain functions, amdpstatepowersupplynotifier and amdpstateprofileset, ...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreqdbsgovernorinit error path When kobjectinitandadd fails, cpufreqdbsgovernorinit calls kobjectput&dbsdata-attrset.kobj. The kobject release callback cpufreqdbsdatarelease calls...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Fixed a kernel panic that occurred when loading the driver. After loading the amd-pstate-ut driver, the functions amdpstateutcheckperf and amdpstateutcheckfreq use cpufreqcpuget to obtain the CPU’s policy...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cpufreq: The completion function is called before kobjectinitandadd. In cpufreqpolicyalloc, the uninitialized completion function is called in cpufreqsysfsrelease when kobjectinitandadd fails. This will cause a crash, such as a...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-hw: Fix memory leak in qcomcpufreqhwreadlut If “cpudev” fails to obtain the opp table in qcomcpufreqhwreadlut, the program returns, causing the “table” resource to remain unreleased...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: cpufreq: schedutil: Use kobject release method to free sugovtunables The struct sugovtunables is protected by the kobject, so we cannot free it directly. Otherwise, we would encounter a call trace similar to this: ODEBUG: free...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: Using the kobject release method to free dbsdata The struct dbsdata contains a struct govattrset, and the struct govattrset contains a kobject. Since every kobject must have a release method, and we cannot...

CVE-2026-90295

A flaw was found in the cpufreq: imx6q driver within the Linux kernel. When the driver is unbound and then rebound, a static counter is not reset, causing an out-of-bounds write to memory. A local attacker could exploit this vulnerability to trigger a kernel crash, leading to a denial of service...

CVE-2026-90364

A flaw was found in the Linux kernel's ACPI Advanced Configuration and Power Interface processor initialization. During the setup process, if certain driver registration or CPU hotplug state configurations fail, a cpufreq notifier may remain improperly registered. This improper resource cleanup c...

CVE-2026-90296

A flaw was found in the Linux kernel's cpufreq: imx6q driver. This vulnerability involves improper management of device resources when the driver is reloaded or re-initialized. Repeated reloads can lead to a continuous accumulation of memory, which is not properly released. This memory leak could...

SUSE CVE-2026-97904

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

SUSE CVE-2026-97905

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...

CVE-2026-97905

A flaw was found in the Linux kernel's CPU frequency scaling cpufreq subsystem. When creating a frequency policy, the kernel exposes system control files sysfs attributes before the CPU mask memory is zero-initialized. A local user could exploit this race condition by accessing these sysfs...