CVE-2026-97904

Summary

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: initialize policy rwsem before sysfs publication

cpufreq_policy_alloc() initializes policy->rwsem after kobject_init_and_add() has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a policy callback before the semaphore has been initialized.

Initialize policy->rwsem before publishing the policy kobject so sysfs callbacks always see an initialized semaphore.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux2fc3384dc75bf7333384c7a16d12c796f61c3f56 < dc11263cb05ed519758fd135fe08d611bad1f241affected
LinuxLinux2fc3384dc75bf7333384c7a16d12c796f61c3f56 < 27c9b491bf7604e83b50c3bbfa18a30266ff345faffected
LinuxLinux2fc3384dc75bf7333384c7a16d12c796f61c3f56 < 2cee937f779f69b195b37bbec1e888da9bfe9d58affected
LinuxLinux2fc3384dc75bf7333384c7a16d12c796f61c3f56 < 3e5d1bf4bd687beb2cb4e32a07af695455925588affected
LinuxLinux4.2affected
LinuxLinux0 < 4.2unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc3 <= *unaffected

Weaknesses

References