Skip to main content

Linux Kernel EUVDEUVD-2026-48917

| CVE-2026-64373 MEDIUM
Race Condition (CWE-362)
2026-07-25 Linux GHSA-r493-vrrx-v3x2
Denial Of Service Linux Race Condition Red Hat Suse
4.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Local sysfs access with low privilege required; high complexity for race timing; impact is kernel panic only (A:H, C:N, I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 08, 2026 - 17:46 vuln.today
CVSS changed
Sep 08, 2026 - 15:37 NVD
4.7 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 4.7
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Fix hotplug-suspend race during reboot

During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active.

This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference:

Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200

Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress.

[ rjw: Changelog edits ]

AnalysisAI

Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.

Technical ContextAI

The vulnerability (CWE-362, concurrent execution using a shared resource with improper synchronization) resides in the cpufreq governor suspend path of the Linux kernel. During normal system suspend the kernel calls freeze_processes() first, which halts userspace and kernel threads - including CPU hotplug workers - before cpufreq_suspend() touches governor_data. The reboot path (kernel_restart() → device_shutdown()) skips that freeze step, leaving CPU hotplug threads active. A hotplug event removing a CPU can free the per-policy governor_data structure while cpufreq_suspend() still holds a stale pointer to it, triggering a null pointer dereference. The fix adds cpus_read_lock()/cpus_read_unlock() around the suspend logic to serialize against hotplug. CPE cpe:2.3:a:linux:linux:* identifies the kernel itself; affected kernels begin at commit 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 across multiple stable branches.

RemediationAI

Upgrade to a patched Linux kernel: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, or 7.1.4 per the EUVD patch data; upstream fix commits are indexed at git.kernel.org (e.g., https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639). Ubuntu users should apply the kernel packages referenced in USN-8726-1 and USN-8727-1. If patching immediately is not feasible, restrict unprivileged access to CPU hotplug sysfs nodes (e.g., chmod 700 or remove group/world write on /sys/devices/system/cpu/cpuN/online) to prevent low-privilege users from triggering hotplug during a reboot window - note this may interfere with power management daemons or container runtimes that rely on hotplug. Given the low EPSS and DoS-only impact, this patch can typically be bundled into the next regular kernel maintenance cycle.

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-48917 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy