In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0a58d3e77b22b087a57831c87cafd360e144a5bd cve-icon cve-icon
https://git.kernel.org/stable/c/15ac9579ebdaf22a37d7f60b3a8efc1029732ef9 cve-icon cve-icon
https://git.kernel.org/stable/c/57e4a6aadf12578b96a038373cffd54b3a58b092 cve-icon cve-icon
https://git.kernel.org/stable/c/69a18ff6c60e8e113420f15355fad862cb45d38e cve-icon cve-icon
https://git.kernel.org/stable/c/69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 cve-icon cve-icon
https://git.kernel.org/stable/c/ad4e8f9bdbef11a19b7cb93e7f313bf59bdcc3b4 cve-icon cve-icon
https://git.kernel.org/stable/c/ba63d4e9857a72a89e71a4eff9f2cc8c283e94c3 cve-icon cve-icon
https://git.kernel.org/stable/c/bc26564bcc659beb6d977cd6eb394041ec2f2851 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025111245-CVE-2025-40194-d959@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-40194 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-40194 cve-icon
History

Thu, 13 Nov 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Thu, 13 Nov 2025 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Wed, 12 Nov 2025 22:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later.
Title cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-11-12T21:56:32.025Z

Updated: 2025-11-12T21:56:32.025Z

Reserved: 2025-04-16T07:20:57.178Z

Link: CVE-2025-40194

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-11-12T22:15:46.427

Modified: 2025-11-14T16:42:30.503

Link: CVE-2025-40194

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-11-12T00:00:00Z

Links: CVE-2025-40194 - Bugzilla